2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

CVE-2026-75621

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-10-12 发布INFO

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-75095

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to unco

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

CVE-2026-75076

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

CVE-2026-75063

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot d...

CVE-2026-75061

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker cou

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

CVE-2026-19627

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain app

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

CVE-2026-19622

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due t

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

CVE-2026-19620

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to impr

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web U...

CVE-2026-18541

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level acce...

CVE-2026-17475

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belon

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-10-12 发布INFO

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authentica...

CVE-2026-109675

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers...

CVE-2026-109674

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized whe...

CVE-2026-109673

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Auth...

CVE-2026-109672

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal page...

CVE-2026-109671

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers wit...

CVE-2026-109670

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by re

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on r...

CVE-2026-109669

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain e

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated user...

CVE-2026-109668

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request an...

CVE-2026-109667

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inven...

CVE-2026-109666

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862