2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio dec...

CVE-2026-109226

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-12 发布INFO

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/au...

CVE-2026-109225

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet...

CVE-2026-109206

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a...

CVE-2026-109205

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesti...

CVE-2026-109204

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-640

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF docu...

CVE-2026-109203

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by...

CVE-2026-109202

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify un...

CVE-2026-109201

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operation

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without s...

CVE-2026-109200

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XML

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in Docum...

CVE-2026-109199

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to exec

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidate...

CVE-2026-109170

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataS...

CVE-2026-109169

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execu

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-12 发布INFO

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/sr...

CVE-2026-108890

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the func

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-285

漏洞预警2026-10-12 发布INFO

Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository...

CVE-2026-103502

Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections t

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-636

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing c...

CVE-2026-93695

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when con

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insu...

CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-116 #cwe-306 #cwe-918

漏洞预警2026-10-12 发布INFO

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in product...

CVE-2026-52903

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints la...

CVE-2026-109188

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler o...

CVE-2026-109187

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_i...

CVE-2026-109186

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-915