2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-09 发布INFO

A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door d...

CVE-2026-104117

A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones ...

CVE-2026-104116

A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disr

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_...

CVE-2026-104115

A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. ge

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-09 发布INFO

A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_i...

CVE-2026-104114

A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwa

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-09 发布INFO

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface config...

CVE-2026-104113

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-10-09 发布INFO

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/sr...

CVE-2026-104112

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel mem

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-10-09 发布INFO

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replac...

CVE-2026-104081

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/hel

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-09 发布INFO

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO...

CVE-2026-102916

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-p

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-09 发布INFO

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inc...

CVE-2026-94067

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-10-09 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a t...

CVE-2026-94066

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.

CVE-2026-94065

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue af

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-09 发布INFO

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress T...

CVE-2026-94064

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object I

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-09 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects...

CVE-2026-94063

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management S...

CVE-2026-92085

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Indu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a th...

CVE-2026-62026

Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Reques

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-09 发布INFO

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially ...

CVE-2026-108063

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-09 发布INFO

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through t...

CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-09 发布INFO

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 byte...

CVE-2026-107785

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering sessi

历史摘要 · 未重新核验 · NVD

#cve #cwe-252 #cwe-325 #cwe-394

漏洞预警2026-10-09 发布INFO

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a craf...

CVE-2026-106581

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer

历史摘要 · 未重新核验 · NVD

#cve #cwe-347