2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-06 发布INFO

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can sup...

CVE-2026-105790

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-06 发布INFO

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_...

CVE-2026-105789

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the e

历史摘要 · 未重新核验 · NVD

#cve #cwe-88 #cwe-184

漏洞预警2026-10-06 发布INFO

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_ser...

CVE-2026-105788

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-10-06 发布INFO

Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.

CVE-2025-15591

Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-06 发布INFO

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inhe...

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is nev

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-06 发布INFO

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.

CVE-2026-106016

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-06 发布INFO

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file...

CVE-2026-105919

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-06 发布INFO

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to...

CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-06 发布INFO

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication code...

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-06 发布INFO

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source....

CVE-2026-105834

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-06 发布INFO

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processin...

CVE-2026-56596

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-06 发布INFO

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login....

CVE-2026-105918

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-06 发布INFO

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word l...

CVE-2026-75820

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/w

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-06 发布INFO

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the fi...

CVE-2026-75819

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binar

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-06 发布INFO

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a craft...

CVE-2026-75818

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The deco

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-06 发布INFO

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control...

CVE-2026-105985

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-10-06 发布INFO

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() functi...

CVE-2026-103831

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Pl

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-06 发布INFO

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be ...

CVE-2026-84854

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-06 发布INFO

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() iptfs_skb_reset_frag_walk() advances to the ...

CVE-2026-98372

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-06 发布INFO

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dum...

CVE-2026-98370

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free x

历史摘要 · 未重新核验 · NVD

#cve