2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two pr...

CVE-2026-102596

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup c...

CVE-2026-102539

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 u

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-693

漏洞预警2026-10-12 发布INFO

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-0...

CVE-2026-97691

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on Augus

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access...

CVE-2026-96266

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration par

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level ac...

CVE-2026-96265

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox i

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level a...

CVE-2026-96264

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot pro...

CVE-2026-96263

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level ac...

CVE-2026-96262

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox i

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access...

CVE-2026-96261

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration par

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fix...

CVE-2026-92120

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Use

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-10-12 发布INFO

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes ...

CVE-2026-92119

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users a

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-10-12 发布INFO

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixe...

CVE-2026-92116

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require...

CVE-2026-84360

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes requir

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTo...

CVE-2026-84321

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlle...

CVE-2026-84320

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import,...

CVE-2026-84319

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects re

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an ng...

CVE-2026-84318

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add wr

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx d...

CVE-2026-84317

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfig

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-693

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive to...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits config

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-184

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession

历史摘要 · 未重新核验 · NVD

#cve #cwe-862