2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-09 发布INFO

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite...

CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders pla...

CVE-2026-87841

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthen...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and includ...

CVE-2026-81929

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import en...

CVE-2026-106097

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-09 发布INFO

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snipp...

CVE-2026-106095

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-09 发布INFO

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. As...

CVE-2026-101028

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot re

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-09 发布INFO

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users wi...

CVE-2025-15700

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP arc

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-09 发布INFO

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temp...

CVE-2026-87110

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-09 发布INFO

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollmen...

CVE-2026-87109

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-09 发布INFO

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required re...

CVE-2026-87108

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated w

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-09 发布INFO

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated b...

CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when deliverin

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-10-09 发布INFO

A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUE...

CVE-2026-107911

A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 all

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-10-09 发布INFO

A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a re...

CVE-2026-7827

A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decod

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-09 发布INFO

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes ...

CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation re

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-09 发布INFO

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter respon

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-09 发布INFO

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automati...

CVE-2026-107888

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-09 发布INFO

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->...

CVE-2026-107886

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-10-09 发布INFO

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing...

CVE-2026-107885

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cups

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-08 发布INFO

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutine...

CVE-2026-97032

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because

历史摘要 · 未重新核验 · NVD

#cve