2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through...

CVE-2026-103353

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Func

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-10-01 发布INFO

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user w...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbo...

CVE-2026-103291

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetchi

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-01 发布INFO

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths...

CVE-2026-103290

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service.

历史摘要 · 未重新核验 · NVD

#cve #cwe-35

漏洞预警2026-10-01 发布INFO

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, r...

CVE-2026-103289

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated memb

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-01 发布INFO

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete...

CVE-2026-103288

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with s...

CVE-2026-103287

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-01 发布INFO

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-pri...

CVE-2026-103286

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-10-01 发布INFO

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member da...

CVE-2026-103284

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-01 发布INFO

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypa...

CVE-2026-103283

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-01 发布INFO

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite toke...

CVE-2026-103282

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-01 发布INFO

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staf...

CVE-2026-103281

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-priv

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-01 发布INFO

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site ow...

CVE-2026-103280

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-01 发布INFO

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accoun...

CVE-2026-103279

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-01 发布INFO

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content p...

CVE-2026-103278

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-10-01 发布INFO

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attack...

CVE-2026-103277

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview featur

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can us...

CVE-2026-103276

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-173

漏洞预警2026-10-01 发布INFO

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fie...

CVE-2026-103275

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-01 发布INFO

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, by...

CVE-2026-103274

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Att...

CVE-2026-103273

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can

历史摘要 · 未重新核验 · NVD

#cve #cwe-863