#cwe-863

共收录 2248 条相关情报。

安全公告2026-07-15 发布INFO

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-15 发布INFO

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/...

CVE-2026-59258

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that all

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-07-15 发布INFO

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's priva...

CVE-2026-61643

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without o...

CVE-2026-59258

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organizat...

CVE-2026-53515

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/ss

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-285 #cwe-863

漏洞预警2026-07-15 发布INFO

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_to...

CVE-2026-53512

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306 #cwe-345 #cwe-863

安全公告2026-07-15 发布INFO

Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso

CVE-2026-53515

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/ss

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-269 #cwe-285 #cwe-863

安全公告2026-07-15 发布INFO

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

CVE-2026-53512

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306 #cwe-345 #cwe-863

漏洞预警2026-07-15 发布INFO

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs auto...

CVE-2026-49997

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Docum

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-863

安全公告2026-07-15 发布INFO

FastGPT: workflow runtime can execute another user's private HTTP toolset

CVE-2026-61643

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-07-15 发布INFO

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave...

CVE-2026-62683

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-sid...

CVE-2026-55242

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-863 #cwe-1336

安全公告2026-07-15 发布INFO

File Browser: Trailing-slash delete leaves a stale public share behind

CVE-2026-62683

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-15 发布INFO

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

CVE-2026-55242

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated use

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336 #cwe-863

漏洞预警2026-07-15 发布INFO

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat...

CVE-2026-61644

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/ge

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outsi...

CVE-2026-54563

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a c

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT...

CVE-2026-54560

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-07-15 发布INFO

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

CVE-2026-54560

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-15 发布INFO

Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root

CVE-2026-54563

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-15 发布INFO

FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup

CVE-2026-61644

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/ge

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863