2026-10-11 归档

今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。

← 返回归档列表

漏洞预警2026-10-10 发布INFO

Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: f...

CVE-2026-66435

Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-10-10 发布INFO

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata...

CVE-2026-108165

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-10 发布INFO

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users...

CVE-2026-108164

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-10 发布INFO

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthentica...

CVE-2026-108163

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-10 发布INFO

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unco...

CVE-2026-108162

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-10-10 发布INFO

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls ...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-10 发布INFO

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVE-2026-105885

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue af

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-10 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Formina...

CVE-2026-102388

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminato

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this un...

CVE-2026-107794

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typema

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-10-10 发布INFO

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::st...

CVE-2026-107373

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringi

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-10 发布INFO

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this ...

CVE-2013-10076

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT type

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-10-10 发布INFO

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empt...

CVE-2026-103636

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_uni

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-191

漏洞预警2026-10-10 发布INFO

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_thet...

CVE-2026-103635

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). com

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-190

漏洞预警2026-10-10 发布INFO

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deseri...

CVE-2026-103513

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A c

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-787

漏洞预警2026-10-10 发布INFO

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer ...

CVE-2026-103501

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deseri

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-1284

漏洞预警2026-10-10 发布INFO

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and r...

CVE-2026-108506

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-10 发布INFO

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HT...

CVE-2026-106139

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-10-10 发布INFO

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML w...

CVE-2026-106138

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Char

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-10-10 发布INFO

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modu...

CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-10 发布INFO

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up ...

CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logou

历史摘要 · 未重新核验 · NVD

#cve #cwe-79