2026-10-14 归档

今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-12 发布INFO

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerabil...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential tim

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authenticati...

CVE-2026-83535

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigur

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

CVE-2026-78404

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd uti

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKe...

CVE-2026-65954

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\Abstr

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-10-12 发布INFO

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated u...

CVE-2026-59977

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanen

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-12 发布INFO

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authen...

CVE-2026-59976

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized conve

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-12 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter direct...

CVE-2026-57143

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG prov

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitiv...

CVE-2026-18166

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-12 发布INFO

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.ph...

CVE-2026-108922

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affecte

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-12 发布INFO

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_...

CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-12 发布INFO

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component ...

CVE-2026-108920

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown fun

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component St...

CVE-2026-108919

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown func

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default Thread...

CVE-2026-107226

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

历史摘要 · 未重新核验 · NVD

#cve #cwe-384 #cwe-693

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

CVE-2026-105466

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a tabl

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

CVE-2026-105465

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due t...

CVE-2026-105464

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly ena...

CVE-2026-104102

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outsi...

CVE-2026-103061

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a pat...

CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

漏洞预警2026-10-12 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin head...

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-1385