2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete ar...

CVE-2026-74031

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file h

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Att...

CVE-2026-74030

Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-776

漏洞预警2026-10-13 发布INFO

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the se...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-13 发布INFO

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url p...

CVE-2026-109966

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-10-13 发布INFO

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository....

CVE-2026-109965

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布INFO

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. ...

CVE-2026-109964

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pic

历史摘要 · 未重新核验 · NVD

#cve #cwe-124

漏洞预警2026-10-13 发布INFO

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyi...

CVE-2026-109963

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API ...

CVE-2026-109962

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-10-13 发布INFO

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database vi...

CVE-2026-109961

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-10-13 发布INFO

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme v...

CVE-2026-109960

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching ...

CVE-2026-109959

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited fie

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search ...

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read re

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by sup...

CVE-2026-109957

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Im

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Atta...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.paths

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, se...

CVE-2026-109953

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin o

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-13 发布INFO

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_respon...

CVE-2026-109952

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against it

历史摘要 · 未重新核验 · NVD

#cve #cwe-757

漏洞预警2026-10-13 发布INFO

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious ba...

CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freer

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counte...

CVE-2026-109949

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartca

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-13 发布INFO

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Se...

CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call th

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redir...

CVE-2026-109947

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP s

历史摘要 · 未重新核验 · NVD

#cve #cwe-770