2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortab...

CVE-2026-112954

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses pub

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requ...

CVE-2026-112953

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictab

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boo...

CVE-2026-112952

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its Tiny...

CVE-2026-112951

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing con

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret back...

CVE-2026-112950

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, is

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that ...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-306

漏洞预警2026-10-20 发布INFO

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and ...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-552

漏洞预警2026-10-20 发布INFO

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by ...

CVE-2026-112947

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outsid

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200 #cwe-209

漏洞预警2026-10-20 发布INFO

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths in...

CVE-2026-112946

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-284

漏洞预警2026-10-20 发布INFO

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchan...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-10-20 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects Sur...

CVE-2026-112840

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.

CVE-2026-112836

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-20 发布INFO

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a ...

CVE-2026-112829

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured...

CVE-2026-112824

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.

CVE-2026-112823

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox:...

CVE-2026-111843

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous ...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to v

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-20 发布INFO

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task rea...

CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTask

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-1188

漏洞预警2026-10-20 发布INFO

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to...

CVE-2026-111763

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromis

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-20 发布INFO

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.Thi...

CVE-2026-109700

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting

历史摘要 · 未重新核验 · NVD

#cve #cwe-862