2026-10-12 归档

今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。

漏洞预警2026-10-11 发布INFO

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never a...

CVE-2026-108865

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obt

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-11 发布INFO

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router l...

CVE-2026-108858

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied a

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-11 发布INFO

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a reda...

CVE-2026-108857

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-11 发布INFO

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/...

CVE-2026-108757

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-11 发布INFO

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operati...

CVE-2026-108756

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restr...

CVE-2026-108727

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url ex...

CVE-2026-108719

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reac

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-10 发布INFO

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

CVE-2026-107420

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-12 发布INFO

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code exe...

CVE-2026-66086

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling informa

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-11 发布INFO

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebSta...

CVE-2026-108860

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to f

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-10-11 发布INFO

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthe...

CVE-2026-108753

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which s

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-11 发布INFO

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the ar...

CVE-2026-108576

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the compon

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-11 发布INFO

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress ...

CVE-2026-86717

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, al...

CVE-2026-86706

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitr...

CVE-2026-85121

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to upd...

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some o

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-11 发布INFO

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any use...

CVE-2026-84737

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-11 发布INFO

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, ...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request again

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-11 发布INFO

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure...

CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure ...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when u

历史摘要 · 未重新核验 · NVD

#cve #cwe-862