#cwe-863

共收录 2098 条相关情报。

← 返回所有主题
漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explici...

CVE-2026-56838

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks

来源摘录 · NVD

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-...

CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its

来源摘录 · NVD

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

安全公告2026-10-23 发布INFO

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw ...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_

来源摘录 · NVD

安全公告2026-10-22 发布INFO

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources...

CVE-2026-115509

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-22 发布MEDIUM

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership che...

CVE-2026-115509

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

来源摘录 · NVD

漏洞预警2026-10-22 发布LOW

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers wi...

CVE-2026-115369

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a C

来源摘录 · NVD

漏洞预警2026-10-22 发布MEDIUM

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the...

CVE-2026-108360

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

安全公告2026-10-22 发布INFO

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

CVE-2026-114132

## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

CVE-2026-114131

### Summary Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-22 发布MEDIUM

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative attacker to bypass ...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allow

来源摘录 · NVD

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue...

CVE-2026-96398

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing....

CVE-2026-96384

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Merma

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue...

CVE-2026-96373

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This...

CVE-2026-96370

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform v

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue...

CVE-2026-96366

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue...

CVE-2026-96356

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful...

CVE-2026-84920

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affect

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-22 发布INFO

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing....

CVE-2026-84917

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonap

历史摘要 · 未重新核验 · GitHub Advisory