2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-09 发布INFO

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quot...

CVE-2026-108269

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0,

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-09 发布INFO

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certif...

CVE-2026-108268

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to t

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-09 发布INFO

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bou...

CVE-2026-108267

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasy

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-09 发布INFO

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` su...

CVE-2026-92705

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation script

历史摘要 · 未重新核验 · NVD

#cve #cwe-158 #cwe-829

漏洞预警2026-10-09 发布INFO

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens...

CVE-2026-62376

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-916

漏洞预警2026-10-09 发布INFO

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an Open...

CVE-2026-62367

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator e

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290 #cwe-345

漏洞预警2026-10-09 发布INFO

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challeng...

CVE-2026-108266

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. P

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-09 发布INFO

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path place...

CVE-2026-108265

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0,

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-09 发布INFO

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url val...

CVE-2026-108260

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-compone

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-09 发布INFO

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value...

CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMI

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-09 发布INFO

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it int...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-09 发布INFO

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password...

CVE-2026-107857

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-522

漏洞预警2026-10-09 发布INFO

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientFo...

CVE-2026-107856

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit appl

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-09 发布INFO

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serve...

CVE-2026-107854

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billin

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-09 发布INFO

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checko...

CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-09 发布INFO

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches ...

CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-524 #cwe-863

漏洞预警2026-10-09 发布INFO

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContai...

CVE-2026-107850

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-09 发布INFO

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard ru...

CVE-2026-107848

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN o

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-09 发布INFO

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.

CVE-2026-78797

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-09 发布INFO

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory wi...

CVE-2026-107844

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-22