2026-10-03 归档

今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-AC...

CVE-2026-104438

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-02 发布INFO

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking correspon...

CVE-2026-104437

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a Z

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-02 发布INFO

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator v...

CVE-2026-104436

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust b

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-02 发布INFO

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. ...

CVE-2026-104435

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs sign

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-02 发布INFO

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling rec...

CVE-2026-104434

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedr

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-02 发布INFO

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip s...

CVE-2026-104432

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-ha

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-10-02 发布INFO

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive syn...

CVE-2026-104431

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers b

历史摘要 · 未重新核验 · NVD

#cve #cwe-405

漏洞预警2026-10-02 发布INFO

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preced...

CVE-2026-104430

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcash

历史摘要 · 未重新核验 · NVD

#cve #cwe-628

漏洞预警2026-10-02 发布INFO

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the...

CVE-2026-104429

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as dir

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-02 发布INFO

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations ...

CVE-2026-104428

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-02 发布INFO

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning paren...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-10-02 发布INFO

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction ...

CVE-2026-104426

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clon

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-02 发布INFO

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invali...

CVE-2026-104425

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg

历史摘要 · 未重新核验 · NVD

#cve #cwe-405

漏洞预警2026-10-02 发布INFO

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Att...

CVE-2026-104424

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits hea

历史摘要 · 未重新核验 · NVD

#cve #cwe-131

漏洞预警2026-10-02 发布INFO

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transac...

CVE-2026-104423

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers

历史摘要 · 未重新核验 · NVD

#cve #cwe-405

漏洞预警2026-10-02 发布INFO

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip be...

CVE-2026-104422

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptS

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-02 发布INFO

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. ...

CVE-2026-104421

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading o

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-10-02 发布INFO

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever pee...

CVE-2026-104419

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-02 发布INFO

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. At...

CVE-2026-104418

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-02 发布INFO

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the...

CVE-2026-104417

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-22