2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-06 发布INFO

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a craft...

CVE-2026-106188

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass syst

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-06 发布INFO

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafte...

CVE-2026-106187

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outsi...

CVE-2026-106186

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a l

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-10-06 发布INFO

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions ...

CVE-2026-106185

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-06 发布INFO

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severit...

CVE-2026-106184

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-10-06 发布INFO

Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. ...

CVE-2026-106183

Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to o

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106182

UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-10-06 发布INFO

Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive informa...

CVE-2026-106181

Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had com

历史摘要 · 未重新核验 · NVD

#cve #cwe-706

漏洞预警2026-10-06 发布INFO

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium ...

CVE-2026-106180

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obt

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-06 发布INFO

UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severit...

CVE-2026-106179

UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI ele

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-10-06 发布INFO

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() inc...

CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

历史摘要 · 未重新核验 · NVD

#cve #cwe-509

漏洞预警2026-10-06 发布INFO

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read(...

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-10-06 发布INFO

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array ind...

CVE-2026-106120

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownProper

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-06 发布INFO

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured...

CVE-2026-106119

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enfor

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-06 发布INFO

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4...

CVE-2026-106118

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using Ti

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-06 发布INFO

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, t...

CVE-2026-106033

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-06 发布INFO

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and dele...

CVE-2026-105488

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a capture...

CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-10-06 发布INFO

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset...

CVE-2026-104945

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-06 发布INFO

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invali...

CVE-2026-104944

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon.

历史摘要 · 未重新核验 · NVD

#cve #cwe-823