2026-10-03 归档

今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64,...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into ...

CVE-2026-104457

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filte

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL L...

CVE-2026-104456

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a st

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS actio...

CVE-2026-104455

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to craf...

CVE-2026-104453

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSR...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSR...

CVE-2026-104451

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to re

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with wr...

CVE-2026-104450

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts e...

CVE-2026-104449

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_call...

CVE-2026-104448

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanentl

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET re...

CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attac...

CVE-2026-104446

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauth...

CVE-2026-104445

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pa...

CVE-2026-104444

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless ...

CVE-2026-104443

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a sy...

CVE-2026-104442

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via th...

CVE-2026-104441

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonc...

CVE-2026-104440

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through diff...

CVE-2026-104439

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-204