2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

安全公告2026-10-08 发布INFO

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

CVE-2026-107721

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-613 #cwe-682

安全公告2026-10-08 发布INFO

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

CVE-2026-107720

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-347

安全公告2026-10-08 发布INFO

fast-jwt: Verifier cache accepts expired JWTs without iat.

CVE-2026-107719

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can contin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-613

安全公告2026-10-08 发布INFO

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

CVE-2026-107716

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry d

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-59

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another host after an HTTP redirect

CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to a different scheme or port after a redirect

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-319 #cwe-522

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another origin after a meta refresh

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

漏洞预警2026-10-10 发布INFO

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due ...

CVE-2026-104742

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass i

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/aut...

CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oau

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-09 发布INFO

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allow...

CVE-2026-107841

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-09 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles bounda...

CVE-2026-107835

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.P

历史摘要 · 未重新核验 · NVD

#cve #cwe-436

漏洞预警2026-10-09 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes...

CVE-2026-107834

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multip

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-772

漏洞预警2026-10-09 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignor...

CVE-2026-107833

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessRes

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-09 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded fl...

CVE-2026-107826

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON i

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-09 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.Parse...

CVE-2026-107825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-436

漏洞预警2026-10-09 发布INFO

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-a...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx r...

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cg...

CVE-2026-78796

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-09 发布INFO

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVE-2026-78795

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-09 发布INFO

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this...

CVE-2026-85479

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

历史摘要 · 未重新核验 · NVD

#cve #cwe-306