2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropd...

CVE-2026-103249

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to s...

CVE-2026-103247

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow c

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credenti...

CVE-2026-103246

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Un...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signa

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-01 发布INFO

Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-S...

CVE-2026-103082

Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-01 发布INFO

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of res...

CVE-2026-96577

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network inter

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marke...

CVE-2026-96256

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter...

CVE-2026-92144

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploi...

CVE-2026-83589

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) du

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-01 发布INFO

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated...

CVE-2026-7176

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/custom_form/edit during the process of creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that ...

CVE-2026-7175

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/di...

CVE-2026-7174

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted UR...

CVE-2026-7173

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability cou

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.

CVE-2026-75786

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL inje

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-01 发布INFO

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pa...

CVE-2026-64950

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

CVE-2026-64949

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar f

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-01 发布INFO

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

CVE-2026-64948

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code...

CVE-2026-64947

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-434

漏洞预警2026-10-01 发布INFO

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrat...

CVE-2026-64946

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Script

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-352

漏洞预警2026-10-01 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visit...

CVE-2026-34190

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidat

历史摘要 · 未重新核验 · NVD

#cve #cwe-352