2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration pl...

CVE-2026-113669

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passpor

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not...

CVE-2026-113668

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:_id/loc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA ...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-rec

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a proje...

CVE-2026-113666

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of Apostrophe

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1321

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations direc...

CVE-2026-113665

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATC

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized ...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supp...

CVE-2026-113662

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-943

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-defa...

CVE-2026-113661

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine w...

CVE-2026-113660

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parse...

CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-1321

漏洞预警2026-10-20 发布INFO

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-I...

CVE-2026-113507

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/pu

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-10-20 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Cont...

CVE-2026-112861

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-data

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitiv...

CVE-2026-111756

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-212

漏洞预警2026-10-20 发布INFO

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching...

CVE-2026-105772

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance th...

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belongi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863 #cwe-1220

漏洞预警2026-10-20 发布INFO

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

CVE-2026-28331

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated p

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious conten...

CVE-2026-28330

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application ...

CVE-2026-28329

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-20 发布INFO

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their ...

CVE-2026-28328

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privil

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system te...

CVE-2026-113658

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV co

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-459 #cwe-770