2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-13 发布INFO

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and execute...

CVE-2026-89117

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with t...

CVE-2026-89116

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This al

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-13 发布INFO

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted...

CVE-2026-89113

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-13 发布INFO

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an ...

CVE-2026-89112

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization c

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered ...

CVE-2026-89106

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could

历史摘要 · 未重新核验 · NVD

#cve #cwe-183

漏洞预警2026-10-13 发布INFO

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing una...

CVE-2026-89105

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from uninte

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-10-13 发布INFO

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenti...

CVE-2026-76976

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-suppli

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated use...

CVE-2026-76975

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the appl...

CVE-2026-76972

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker...

CVE-2026-58249

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-10-13 发布INFO

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the...

CVE-2026-58242

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker thro

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-10-13 发布INFO

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobacke...

CVE-2026-108945

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-13 发布INFO

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of t...

CVE-2026-108944

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-13 发布INFO

A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3_runner...

CVE-2026-108943

A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained o

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-13 发布INFO

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file mod...

CVE-2026-108942

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-13 发布INFO

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVE-2026-93886

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to imprope

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-81858

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain informa

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-13 发布INFO

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit imp...

CVE-2026-19938

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluet

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布INFO

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT message c...

CVE-2026-19937

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static po

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-10-13 发布INFO

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_de...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive

历史摘要 · 未重新核验 · NVD

#cve #cwe-362