#cwe-863

共收录 2118 条相关情报。

漏洞预警2026-08-17 发布INFO

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-08-17 发布INFO

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user wh...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-17 发布INFO

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user...

CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

安全公告2026-08-17 发布INFO

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unaut

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-08-17 发布INFO

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant record...

CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls,

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submit...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an ex...

CVE-2026-44846

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a us

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscriptio...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed clust

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel admini...

CVE-2026-16048

Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignm

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to m...

CVE-2026-16046

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for f

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessi...

CVE-2026-16045

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and person

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board memb...

CVE-2026-16044

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privile

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting ...

CVE-2026-15754

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System...

CVE-2026-10527

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-16 发布INFO

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route...

CVE-2026-73059

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChann

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-08-16 发布INFO

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. At...

CVE-2026-73059

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChann

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-15 发布INFO

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege...

CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:critical

漏洞预警2026-08-15 发布INFO

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The v...

CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-14 发布INFO

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By...

CVE-2026-74248

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another projec

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

漏洞预警2026-08-14 发布MEDIUM

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may...

CVE-2026-74248

OpenStack Octavia 是 OpenStack 生态中的负载均衡服务组件，负责管理虚拟负载均衡器（amphora）。在 18.0.0 及之前版本中，Octavia 对服务质量（QoS）策略的授权处理存在缺陷，导致已认证用户可以将

历史摘要 · 未重新核验 · NVD

#cve #cwe-863