2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm cha...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by for...

CVE-2026-109373

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-12 发布INFO

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using th...

CVE-2026-109372

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flo...

CVE-2026-109371

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks ...

CVE-2026-109366

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-354

漏洞预警2026-10-12 发布INFO

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies ...

CVE-2026-109365

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to forc

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-12 发布INFO

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addres...

CVE-2026-109364

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-12 发布INFO

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re...

CVE-2026-109363

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-12 发布INFO

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execu...

CVE-2026-109362

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep exec

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-12 发布INFO

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json wi...

CVE-2026-109361

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postpro

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over pla...

CVE-2026-109360

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generatio...

CVE-2026-109359

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and a...

CVE-2026-109357

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because userna

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privilege...

CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers c...

CVE-2026-109355

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Ox

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ seq...

CVE-2026-109354

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notificatio...

CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, pop...

CVE-2026-109352

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.p

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch

历史摘要 · 未重新核验 · NVD

#cve #cwe-617