2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly ena...

CVE-2026-104102

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outsi...

CVE-2026-103061

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a pat...

CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

漏洞预警2026-10-12 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictRead...

CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined read

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-276

漏洞预警2026-10-12 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin head...

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-1385

漏洞预警2026-10-12 发布INFO

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field c...

CVE-2026-6232

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-12 发布INFO

Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: fr...

CVE-2026-61994

Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Condit...

CVE-2026-42689

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Ev

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-12 发布INFO

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap me...

CVE-2026-109448

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters t

历史摘要 · 未重新核验 · NVD

#cve #cwe-124 #cwe-190

漏洞预警2026-10-12 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been re...

CVE-2026-109222

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url ...

CVE-2026-108916

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAcce

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-10-12 发布INFO

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from...

CVE-2026-108486

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Co

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows S...

CVE-2026-108482

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium A

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a thr...

CVE-2026-108481

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request F

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-12 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a thr...

CVE-2026-108479

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request F

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-12 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.Th...

CVE-2026-107862

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz A

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a ...

CVE-2026-107418

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through...

CVE-2026-103080

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data

历史摘要 · 未重新核验 · NVD

#cve #cwe-472

漏洞预警2026-10-12 发布INFO

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort para...

CVE-2026-94451

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-12 发布INFO

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, whi...

CVE-2026-85976

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input

历史摘要 · 未重新核验 · NVD

#cve #cwe-113