2026-10-12 归档

今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。

漏洞预警2026-10-11 发布INFO

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documen...

CVE-2026-108734

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_docume

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method...

CVE-2026-108733

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount m...

CVE-2026-108732

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_...

CVE-2026-108731

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated ...

CVE-2026-108730

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments...

CVE-2026-108729

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-11 发布INFO

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment varia...

CVE-2026-108728

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to o

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-10-11 发布INFO

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omittin...

CVE-2026-108726

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /upl...

CVE-2026-108725

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-11 发布INFO

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedEx...

CVE-2026-108724

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving syml...

CVE-2026-108723

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-11 发布INFO

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript tex...

CVE-2026-108722

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-11 发布INFO

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using...

CVE-2026-108721

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-10-11 发布INFO

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, loc...

CVE-2026-108720

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without use...

CVE-2026-108718

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supp...

CVE-2026-108717

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS ...

CVE-2026-108716

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends cl

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-11 发布INFO

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered ...

CVE-2026-108715

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket insta...

CVE-2026-108714

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exh

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-11 发布INFO

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the...

CVE-2026-108713

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-862