2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-09 发布INFO

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to caus...

CVE-2026-75349

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manag

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-09 发布INFO

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue ...

CVE-2026-75348

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-09 发布INFO

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote a...

CVE-2026-75346

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-09 发布INFO

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.

CVE-2026-75345

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-09 发布INFO

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated aut...

CVE-2026-108113

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handl

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-09 发布INFO

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attac...

CVE-2026-108112

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by sup...

CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-09 发布INFO

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicate...

CVE-2026-107814

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtain...

CVE-2026-107812

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates

历史摘要 · 未重新核验 · NVD

#cve #cwe-494

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses seriali...

CVE-2026-107811

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and resto...

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end s...

CVE-2026-107809

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-manage

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasske...

CVE-2026-107808

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-305 #cwe-308

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in ...

CVE-2026-107807

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret mast

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-598

漏洞预警2026-10-09 发布INFO

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console pas...

CVE-2026-107783

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to r

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-09 发布INFO

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against th...

CVE-2026-104084

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-09 发布INFO

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a...

CVE-2026-104083

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-dir...

CVE-2026-104082

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-09 发布INFO

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denia...

CVE-2026-102554

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-502 #cwe-770

漏洞预警2026-10-09 发布INFO

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code exec...

CVE-2026-95702

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-415 #cwe-416