2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service o...

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-13 发布INFO

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/Im...

CVE-2026-54454

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-13 发布INFO

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to wr...

CVE-2026-110116

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager store

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build....

CVE-2026-55675

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829 #cwe-1357

漏洞预警2026-10-13 发布INFO

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers ...

CVE-2024-34323

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK ...

CVE-2026-104192

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStrea

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to wr...

CVE-2026-74043

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated us...

CVE-2026-74041

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-10-13 发布INFO

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite prote...

CVE-2026-74040

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revoc...

CVE-2026-65173

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-13 发布INFO

NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and contai...

CVE-2026-65162

NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-10-13 发布INFO

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109707

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox E

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布INFO

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 1...

CVE-2026-109705

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. T

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布INFO

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an att...

CVE-2026-63354

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before r

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social eng...

CVE-2026-63353

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds t...

CVE-2026-63350

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an a

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-10-13 发布INFO

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive intern...

CVE-2026-44415

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an

历史摘要 · 未重新核验 · NVD

#cve #cwe-35

漏洞预警2026-10-13 发布INFO

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command inject...

CVE-2026-109110

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemo

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-13 发布INFO

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings...

CVE-2026-109109

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-10-13 发布INFO

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Execut...

CVE-2026-108971

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bi

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-347