2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can obse...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-01 发布INFO

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restr...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-01 发布INFO

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access t...

CVE-2026-103269

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site membe

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. A...

CVE-2026-103268

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account...

CVE-2026-103267

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-10-01 发布INFO

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an exis...

CVE-2026-103266

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-01 发布INFO

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results f...

CVE-2026-103265

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results e

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-01 发布INFO

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays...

CVE-2026-103263

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-01 发布INFO

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a ...

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-01 发布INFO

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests w...

CVE-2026-103261

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-01 发布INFO

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume re...

CVE-2026-103260

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resol...

CVE-2026-103259

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credent

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-01 发布INFO

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attack...

CVE-2026-103258

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGr

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource iden...

CVE-2026-103257

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted pa...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow us

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait ap...

CVE-2026-103254

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop oper...

CVE-2026-103253

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves...

CVE-2026-103252

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for...

CVE-2026-103251

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to valid...

CVE-2026-103250

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-943