2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-06 发布INFO

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of ...

CVE-2026-87975

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseMo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-06 发布INFO

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker wh...

CVE-2026-87890

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-06 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox al...

CVE-2026-85523

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Inf

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-06 发布INFO

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-s...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_he

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-06 发布INFO

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects...

CVE-2026-82924

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co.

历史摘要 · 未重新核验 · NVD

#cve #cwe-799

漏洞预警2026-10-06 发布INFO

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potenti...

CVE-2026-77050

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.g

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-06 发布INFO

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L Chi...

CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command I

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-06 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflec...

CVE-2026-12380

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Sof

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-06 发布INFO

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through t...

CVE-2026-106041

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskR...

CVE-2026-106040

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replicatio...

CVE-2026-106039

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-06 发布INFO

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByR...

CVE-2026-106038

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-06 发布INFO

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remo...

CVE-2026-106026

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks hea

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-06 发布INFO

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file...

CVE-2026-105920

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-06 发布INFO

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname....

CVE-2026-105842

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-06 发布INFO

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted fil...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows re

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-06 发布INFO

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current ...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows mal

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-06 发布INFO

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers...

CVE-2026-105839

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-06 发布INFO

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized...

CVE-2026-105838

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-06 发布INFO

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. At...

CVE-2026-105837

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-190