2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user....

CVE-2026-109185

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadA...

CVE-2026-109183

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced...

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding ...

CVE-2026-109181

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds reques...

CVE-2026-109180

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unas

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege use...

CVE-2026-109179

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privileg...

CVE-2026-109178

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supply...

CVE-2026-109177

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkD...

CVE-2026-109176

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POS...

CVE-2026-109175

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Att...

CVE-2026-109174

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoi...

CVE-2026-109173

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /a...

CVE-2026-109172

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/c...

CVE-2026-109171

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplyin...

CVE-2026-109168

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' f...

CVE-2026-109167

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler th

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying a...

CVE-2026-109166

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/c...

CVE-2026-109165

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fiel

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arb...

CVE-2026-109164

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_...

CVE-2026-108953

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command

历史摘要 · 未重新核验 · NVD

#cve #cwe-78