2026-10-07 归档

今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-05 发布INFO

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify t...

CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the cal...

CVE-2026-105693

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller ...

CVE-2026-105692

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to ass...

CVE-2026-105688

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but ...

CVE-2026-105687

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-863

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already s...

CVE-2026-105686

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data st...

CVE-2026-105683

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff

历史摘要 · 未重新核验 · NVD

#cve #cwe-35

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost ...

CVE-2026-105682

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature al

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issu...

CVE-2026-105681

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in ...

CVE-2026-105680

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. O...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contribu...

CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-863

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to exec...

CVE-2026-105677

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme transla

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94 #cwe-829

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read...

CVE-2026-105676

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme transla

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invit...

CVE-2026-105675

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invite

历史摘要 · 未重新核验 · NVD

#cve #cwe-203 #cwe-943

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. T...

CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the re

历史摘要 · 未重新核验 · NVD

#cve #cwe-203 #cwe-943

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as book...

CVE-2026-105651

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post...

CVE-2026-105650

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled websi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-184

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitizati...

CVE-2026-105649

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434