2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...

CVE-2026-96299

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrit

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-13 发布INFO

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.

CVE-2026-78802

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...

CVE-2026-104005

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrit

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-13 发布INFO

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has t...

CVE-2026-9218

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-13 发布INFO

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output ...

CVE-2026-53711

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts fe

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having networ...

CVE-2026-11732

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR route

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-13 发布INFO

Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauth...

CVE-2026-107918

Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated admini

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-13 发布INFO

Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unau...

CVE-2026-107917

Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-13 发布INFO

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double pa...

CVE-2026-109955

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-174

漏洞预警2026-10-13 发布INFO

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request in...

CVE-2026-109954

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-13 发布INFO

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Atta...

CVE-2026-109950

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-13 发布INFO

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_...

CVE-2026-109942

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c beca

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-13 发布INFO

FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked re...

CVE-2026-109941

FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the con...

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint retu

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-13 发布INFO

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backen...

CVE-2026-78557

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initi...

CVE-2026-78556

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software doe

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-13 发布INFO

A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge D...

CVE-2026-44414

A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, In

历史摘要 · 未重新核验 · NVD

#cve #cwe-35

漏洞预警2026-10-12 发布INFO

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindi...

CVE-2026-53922

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthe

历史摘要 · 未重新核验 · NVD

#cve #cwe-121 #cwe-191

漏洞预警2026-10-12 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go tre...

CVE-2026-41508

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multip

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-755

漏洞预警2026-10-12 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writ...

CVE-2026-41504

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native

历史摘要 · 未重新核验 · NVD

#cve #cwe-93 #cwe-117