2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

← 返回归档列表

漏洞预警2026-10-12 发布INFO

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature al...

CVE-2026-92877

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE)

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-10-12 发布INFO

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cr...

CVE-2026-108898

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Sett

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebVie...

CVE-2026-108897

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted e

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_im...

CVE-2026-108094

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker w

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-12 发布INFO

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation rest...

CVE-2026-103537

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and rem

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` para...

CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chain

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can ...

CVE-2026-103529

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without val

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressio...

CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenti

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (X...

CVE-2026-103527

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “ne

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticat...

CVE-2026-103526

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-10-12 发布INFO

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanit...

CVE-2026-103524

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied in

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, ...

CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrativ...

CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on c

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-12 发布INFO

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An att...

CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document upd

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-12 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-68764

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-12 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYA...

CVE-2026-18390

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue af...

CVE-2026-12613

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYA

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in Nan...

CVE-2026-109229

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection proc

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-12 发布INFO

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_to...

CVE-2026-109228

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V vid

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_p...

CVE-2026-109227

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decod

历史摘要 · 未重新核验 · NVD

#cve #cwe-770