2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the clie...

CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion,

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one ...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONN

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the del...

CVE-2026-109944

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-13 发布INFO

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when nu...

CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a k...

CVE-2026-109940

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-13 发布INFO

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when ...

CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/co

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-13 发布INFO

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redi...

CVE-2026-109938

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-13 发布INFO

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested us...

CVE-2026-109680

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the b

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-13 发布INFO

FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL rea...

CVE-2026-109678

FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachab

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-13 发布INFO

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. M...

CVE-2026-109677

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-13 发布INFO

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an inv...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布INFO

A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Disp...

CVE-2026-109520

A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-267

漏洞预警2026-10-13 发布INFO

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The mani...

CVE-2026-109519

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of ...

CVE-2026-109410

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImp

历史摘要 · 未重新核验 · NVD

#cve #cwe-682

漏洞预警2026-10-13 发布INFO

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts o...

CVE-2026-109409

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-10-13 发布INFO

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not low...

CVE-2026-107832

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowerc

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-10-13 发布INFO

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to ...

CVE-2026-103499

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-13 发布INFO

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of ...

CVE-2026-0893

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unautho

历史摘要 · 未重新核验 · NVD

#cve #cwe-213

漏洞预警2026-10-13 发布INFO

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability coul...

CVE-2025-58774

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local a

历史摘要 · 未重新核验 · NVD

#cve #cwe-805

漏洞预警2026-10-13 发布INFO

AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer over...

CVE-2025-58773

AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-787