2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated member...

CVE-2026-110113

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because t...

CVE-2026-110110

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via PO...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/stora...

CVE-2026-110108

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage obje

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplyi...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying...

CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits r...

CVE-2026-110105

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalte...

CVE-2026-110104

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-10-13 发布INFO

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in P...

CVE-2026-110103

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integr...

CVE-2026-110102

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables T

历史摘要 · 未重新核验 · NVD

#cve #cwe-494

漏洞预警2026-10-13 发布INFO

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restri...

CVE-2026-110101

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitra...

CVE-2026-110100

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated us...

CVE-2026-110099

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizi...

CVE-2026-110098

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token....

CVE-2026-110097

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-13 发布INFO

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neut...

CVE-2026-10759

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Direc

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-10-13 发布INFO

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W...

CVE-2026-109898

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Confi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configure...

CVE-2026-109896

Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integratio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels...

CVE-2026-109890

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploit

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a ...

CVE-2026-109828

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-453 #cwe-457