2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration val...

CVE-2026-109328

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresent

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inj...

CVE-2026-109327

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthentic...

CVE-2026-109326

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 con

历史摘要 · 未重新核验 · NVD

#cve #cwe-527

漏洞预警2026-10-12 发布INFO

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind...

CVE-2026-109325

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loop

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers...

CVE-2026-109324

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory b

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-12 发布INFO

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readon...

CVE-2026-109323

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitor

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message f...

CVE-2026-109322

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and A

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthen...

CVE-2026-109320

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows di

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-12 发布INFO

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. ...

CVE-2026-109319

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in A

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions i...

CVE-2026-109318

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admi...

CVE-2026-109317

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Adm...

CVE-2026-109316

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list o...

CVE-2026-109315

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Cloc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset rou...

CVE-2026-109314

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through rememb...

CVE-2026-109313

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-12 发布INFO

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA se...

CVE-2026-109312

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the se

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-12 发布INFO

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote att...

CVE-2026-109311

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFm

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-12 发布INFO

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader,...

CVE-2026-109310

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content p

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Pat...

CVE-2026-109309

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanse...

CVE-2026-109308

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::acti

历史摘要 · 未重新核验 · NVD

#cve #cwe-94