2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsan...

CVE-2012-20003

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unau

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href pa...

CVE-2012-20002

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second o...

CVE-2026-86413

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl coul

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--c...

CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the ne

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a c...

CVE-2026-86411

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy ha

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redi...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly u

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends a...

CVE-2026-86409

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentatio

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or ...

CVE-2026-113869

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decryp

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-20 发布INFO

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge tha...

CVE-2026-113868

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was va

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP us...

CVE-2026-113867

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming request

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes ba...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escap

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-116

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode b...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion err

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt....

CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to ...

CVE-2026-113722

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is ...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later env...

CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _un...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or desti...

CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote()

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(do...

CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd(

历史摘要 · 未重新核验 · NVD

#cve #cwe-494

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensu

历史摘要 · 未重新核验 · NVD

#cve #cwe-59