2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() cou...

CVE-2026-106108

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_pattern...

CVE-2026-103028

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy p

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accept...

CVE-2026-102603

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the pass

历史摘要 · 未重新核验 · NVD

#cve #cwe-620

漏洞预警2026-10-13 发布INFO

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an anim...

CVE-2026-102342

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware up...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be up

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-13 发布INFO

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS a...

CVE-2024-34319

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVE-2026-95680

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to a

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-13 发布INFO

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-93907

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a fla

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated ...

CVE-2026-93347

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent request...

CVE-2026-93346

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (AC...

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path...

CVE-2026-77361

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment ...

CVE-2026-74047

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent ca...

CVE-2026-74045

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from inp

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-13 发布INFO

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked adm...

CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-13 发布INFO

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers contr...

CVE-2026-74036

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a fal...

CVE-2026-74035

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_pat...

CVE-2026-74034

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to rea...

CVE-2026-74033

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB lis

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected sec...

CVE-2026-74032

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated u

历史摘要 · 未重新核验 · NVD

#cve #cwe-863