2026-10-03 归档

今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-02 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78410. Reason: This candidate is a duplicate of CVE-2026-78410. Notes: All CVE users should ...

CVE-2026-104886

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78410. Reason: This candidate is a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-02 发布INFO

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPrope...

CVE-2026-82045

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary en

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-02 发布INFO

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by suppl...

CVE-2026-82044

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP r...

CVE-2026-82043

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-10-02 发布INFO

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges ...

CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-02 发布INFO

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_i...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view refle

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-10-02 发布INFO

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attackers to make the ser...

CVE-2026-82040

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadata

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supply...

CVE-2026-82039

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-02 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

CVE-2026-39718

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret i...

CVE-2026-12392

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-02 发布INFO

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanni...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above

历史摘要 · 未重新核验 · NVD

#cve #cwe-24

漏洞预警2026-10-02 发布INFO

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allow...

CVE-2026-104991

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (sing

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-02 发布INFO

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-us...

CVE-2026-104988

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enroll

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-02 发布INFO

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langg...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-02 发布INFO

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumenta...

CVE-2026-104872

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript application

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-02 发布INFO

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retri...

CVE-2026-104871

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-02 发布INFO

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSm...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-915 #cwe-1321

漏洞预警2026-10-02 发布INFO

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoe...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-915 #cwe-1321

漏洞预警2026-10-02 发布INFO

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to str...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-02 发布INFO

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentia...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918