2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference i...

CVE-2026-18537

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input val

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configurati...

CVE-2026-18533

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input val

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value p...

CVE-2026-18529

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintend...

CVE-2026-18517

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Loca

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

CVE-2026-18513

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access co

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denia...

CVE-2026-16678

IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 cou

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-10-12 发布INFO

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the pro...

CVE-2026-109570

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaire

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --ro...

CVE-2026-109569

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-10-12 发布INFO

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-ad...

CVE-2026-109568

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API cont

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display...

CVE-2026-109565

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_p...

CVE-2026-109564

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash pr...

CVE-2026-109560

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run u

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's a...

CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the Mongo

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-10-12 发布INFO

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attack...

CVE-2026-109380

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entr

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-10-12 发布INFO

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/c...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enum

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-10-12 发布INFO

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating target...

CVE-2026-109378

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-12 发布INFO

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by plantin...

CVE-2026-109375

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows san

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-12 发布INFO

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the ...

CVE-2026-108931

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cg

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Hand...

CVE-2026-108930

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-12 发布INFO

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation ...

CVE-2026-108928

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89