2026-10-03 归档

今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-02 发布INFO

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component P...

CVE-2026-104054

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-02 发布INFO

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manipulation...

CVE-2026-104053

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-02 发布INFO

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. This manipulat...

CVE-2026-104052

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-02 发布INFO

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext acr...

CVE-2026-103098

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather th

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-02 发布INFO

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the c...

CVE-2026-103097

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-540 #cwe-798

漏洞预警2026-10-02 发布INFO

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the clie...

CVE-2026-103096

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-540 #cwe-798

漏洞预警2026-10-02 发布INFO

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter...

CVE-2026-103766

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-01 发布INFO

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow pro...

CVE-2026-103761

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-01 发布INFO

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never read...

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-01 发布INFO

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying abs...

CVE-2025-71427

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same conne...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-01 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). ...

CVE-2026-71454

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-sit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

CVE-2026-71453

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-01 发布INFO

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.

CVE-2026-71452

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects Ea

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.

CVE-2026-71449

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-10-01 发布INFO

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.

CVE-2026-71448

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-10-01 发布INFO

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.

CVE-2026-64893

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middl

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-01 发布INFO

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3...

CVE-2026-64892

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resour

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-01 发布INFO

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or com...

CVE-2026-51897

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-sess...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the expos

历史摘要 · 未重新核验 · NVD

#cve