2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor nev...

CVE-2026-113611

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep rec

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other use...

CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can...

CVE-2026-113609

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-20 发布INFO

Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var req...

CVE-2026-113608

Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_co...

CVE-2026-113607

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing fold...

CVE-2026-113606

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using ...

CVE-2026-113605

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-10-20 发布INFO

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program...

CVE-2026-113604

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-20 发布INFO

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vu...

CVE-2026-113603

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character....

CVE-2026-113602

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode tr

历史摘要 · 未重新核验 · NVD

#cve #cwe-147

漏洞预警2026-10-20 发布INFO

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all ...

CVE-2026-113601

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsC...

CVE-2026-113600

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplyin...

CVE-2026-113599

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bul...

CVE-2026-113598

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delet

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByI...

CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other us

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo witho...

CVE-2026-113595

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRP...

CVE-2026-113594

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API e...

CVE-2026-113359

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field val

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacemen...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed b...

CVE-2026-112955

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-400