2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-06 发布INFO

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file bu...

CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-377

漏洞预警2026-10-06 发布INFO

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-blo...

CVE-2026-106450

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() all

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-06 发布INFO

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed em...

CVE-2026-106449

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-06 发布INFO

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assign...

CVE-2026-106448

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map dec

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-10-06 发布INFO

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags thro...

CVE-2026-106447

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recu

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-06 发布INFO

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before a...

CVE-2026-106445

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars looku

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-1289

漏洞预警2026-10-06 发布INFO

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/co...

CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.preco

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-06 发布INFO

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a ...

CVE-2026-106063

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large widt

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-10-06 发布INFO

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record...

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-06 发布INFO

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once ...

CVE-2026-105243

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed s

历史摘要 · 未重新核验 · NVD

#cve #cwe-778

漏洞预警2026-10-06 发布INFO

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validat...

CVE-2026-105242

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Re

历史摘要 · 未重新核验 · NVD

#cve #cwe-755

漏洞预警2026-10-06 发布INFO

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 ...

CVE-2026-105241

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-10-06 发布INFO

Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output...

CVE-2026-105240

Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.

历史摘要 · 未重新核验 · NVD

#cve #cwe-158

漏洞预警2026-10-06 发布INFO

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log rec...

CVE-2026-105239

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL ch

历史摘要 · 未重新核验 · NVD

#cve #cwe-158

漏洞预警2026-10-06 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to g...

CVE-2026-105111

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCE

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-06 发布INFO

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redi...

CVE-2026-104636

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-06 发布INFO

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finis...

CVE-2026-104632

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approve

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-06 发布INFO

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run...

CVE-2026-104626

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gite

历史摘要 · 未重新核验 · NVD

#cve #cwe-841

漏洞预警2026-10-06 发布INFO

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing o...

CVE-2026-104048

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (H

历史摘要 · 未重新核验 · NVD

#cve #cwe-1025

漏洞预警2026-10-06 发布INFO

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local use...

CVE-2026-104047

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before bei

历史摘要 · 未重新核验 · NVD

#cve #cwe-140