2026-10-06 归档

今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-05 发布INFO

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parame

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-05 发布INFO

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the atta...

CVE-2026-71297

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificat

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-05 发布INFO

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c...

CVE-2026-105767

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-05 发布INFO

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify t...

CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly sc...

CVE-2026-105695

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session u

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attrib...

CVE-2026-105694

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the cal...

CVE-2026-105693

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller ...

CVE-2026-105692

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. ...

CVE-2026-105690

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to ass...

CVE-2026-105688

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but ...

CVE-2026-105687

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-863

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already s...

CVE-2026-105686

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissio...

CVE-2026-105684

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data st...

CVE-2026-105683

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff

历史摘要 · 未重新核验 · NVD

#cve #cwe-35

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost ...

CVE-2026-105682

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature al

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issu...

CVE-2026-105681

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in ...

CVE-2026-105680

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. O...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contribu...

CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-863