2026-10-05 归档

今日共收录 815 条安全情报，包含 115 个 CVE，364 篇安全通告，以及 81 篇研究论文。

漏洞预警2026-10-04 发布INFO

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from ...

CVE-2026-105224

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-04 发布INFO

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 U...

CVE-2026-105089

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-04 发布INFO

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in ...

CVE-2026-105086

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-04 发布INFO

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio M...

CVE-2026-104402

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Ret

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-04 发布INFO

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP v...

CVE-2026-105214

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-04 发布INFO

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated org...

CVE-2026-105213

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布INFO

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment ...

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布INFO

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the retu...

CVE-2026-105211

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-04 发布INFO

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act ...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布INFO

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own tok...

CVE-2026-105208

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption,

历史摘要 · 未重新核验 · NVD

#cve #cwe-649

漏洞预警2026-10-04 发布INFO

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization r...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, whi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-04 发布INFO

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected an...

CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-04 发布INFO

A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the compon...

CVE-2026-105158

A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-04 发布INFO

A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the ...

CVE-2026-105157

A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocCon

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-04 发布INFO

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a mani...

CVE-2026-105156

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/syste

历史摘要 · 未重新核验 · NVD

#cve #cwe-326 #cwe-916

漏洞预警2026-10-04 发布INFO

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argum...

CVE-2026-105149

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /st

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-04 发布INFO

A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Complet...

CVE-2026-105148

A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shar

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-04 发布INFO

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_S...

CVE-2026-105147

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Ha

历史摘要 · 未重新核验 · NVD

#cve #cwe-259 #cwe-798

漏洞预警2026-10-04 发布INFO

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This is...

CVE-2026-97307

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculato

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-04 发布INFO

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin...

CVE-2026-105146

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89