2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-12 发布INFO

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of ...

CVE-2026-108927

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unk

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-12 发布INFO

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action ...

CVE-2026-106495

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re...

CVE-2026-105052

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next qu...

CVE-2024-58389

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-12 发布INFO

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. At...

CVE-2021-48011

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escap

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map l

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-12 发布INFO

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, ...

CVE-2020-37279

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute comma

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque ...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack han

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-12 发布INFO

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process...

CVE-2026-95837

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer check

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate...

CVE-2026-109425

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecre

历史摘要 · 未重新核验 · NVD

#cve #cwe-1286

漏洞预警2026-10-12 发布INFO

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies a...

CVE-2026-109424

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-10-12 发布INFO

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the arg...

CVE-2026-108926

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown p

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-12 发布INFO

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the com...

CVE-2026-108923

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-10-12 发布INFO

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested ...

CVE-2026-108362

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

CVE-2026-104364

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

CVE-2026-104332

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-12 发布INFO

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to...

CVE-2025-27902

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external si

历史摘要 · 未重新核验 · NVD

#cve #cwe-1022

漏洞预警2026-10-12 发布INFO

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary Java...

CVE-2025-27897

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary Java...

CVE-2025-27896

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary Java...

CVE-2025-27895

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79