#cwe-863

共收录 2118 条相关情报。

漏洞预警2026-08-01 发布CRITICAL

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute ...

CVE-2026-67341

ArcadeDB 是一个支持SQL和Gremlin的多模型数据库。在版本26.7.2之前，其SQL引擎在处理'DEFINE FUNCTION'语句时，未正确检查用户是否具有执行脚本的授权。具体来说，尽管数据库管理员可以配置仅允许管理员创建J

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-01 发布INFO

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm...

CVE-2026-67310

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-01 发布INFO

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Cha...

CVE-2026-2411

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-01 发布INFO

ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-08-01 发布INFO

openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

CVE-2026-67310

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-07-31 发布INFO

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG...

CVE-2026-18394

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to ob

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/...

CVE-2026-54707

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-07-31 发布INFO

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

CVE-2026-65835

### Summary CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources (e.g

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-269 #cwe-863 #severity:medium

安全公告2026-07-31 发布INFO

OnionShare Receive mode writes uploaded files even when file uploads are disabled

CVE-2026-54707

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-31 发布INFO

OnionShare Receive mode writes uploaded files even when file uploads are disabled

CVE-2026-54707

### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload si

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-863 #severity:medium

漏洞预警2026-07-31 发布INFO

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, ...

CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a gr

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to ove...

CVE-2026-14929

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enfor...

CVE-2026-62323

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the se

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectServi...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin r

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folde...

CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscri

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-07-31 发布INFO

Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

CVE-2026-62323

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the se

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-31 发布INFO

Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin r

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-31 发布INFO

Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscri

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-07-31 发布INFO

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an aut...

CVE-2026-14538

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Googl

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-863

漏洞预警2026-07-31 发布INFO

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools prote...

CVE-2026-14537

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-863