2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-06 发布INFO

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to versio...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-10-06 发布INFO

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/...

CVE-2026-105950

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user ca...

CVE-2026-105844

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys ...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 unt

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a rea...

CVE-2026-105805

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 us...

CVE-2026-105804

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and cana

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-10-06 发布INFO

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of...

CVE-2026-105922

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_an

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-10-06 发布INFO

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_cla...

CVE-2026-105921

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-06 发布INFO

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before render...

CVE-2026-105801

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely ne

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-150

漏洞预警2026-10-06 发布INFO

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace va...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-918

漏洞预警2026-10-06 发布INFO

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters ...

CVE-2026-105799

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-06 发布INFO

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload st...

CVE-2026-105798

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-06 发布INFO

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization o...

CVE-2026-105797

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-863

漏洞预警2026-10-06 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than...

CVE-2026-105796

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-commen

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-06 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or ...

CVE-2026-105795

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-06 发布INFO

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or Qu...

CVE-2026-105794

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20,

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-06 发布INFO

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager...

CVE-2026-105792

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /

历史摘要 · 未重新核验 · NVD

#cve #cwe-833

漏洞预警2026-10-06 发布INFO

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo...

CVE-2026-105791

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the r

历史摘要 · 未重新核验 · NVD

#cve #cwe-88 #cwe-184

漏洞预警2026-10-06 发布INFO

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root be...

CVE-2026-104069

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-06 发布INFO

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Se...

CVE-2025-8352

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumptio

历史摘要 · 未重新核验 · NVD

#cve #cwe-770