2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials...

CVE-2026-107755

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms all

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language ...

CVE-2025-71436

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_t

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-20 发布INFO

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbi...

CVE-2026-97400

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent D

历史摘要 · 未重新核验 · NVD

#cve #cwe-611 #cwe-618

漏洞预警2026-10-20 发布INFO

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulti...

CVE-2026-96402

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, le

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py

CVE-2026-95168

An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thef

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch ...

CVE-2026-95111

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-131

漏洞预警2026-10-20 发布INFO

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the...

CVE-2026-92454

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-835

漏洞预警2026-10-20 发布INFO

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it ag...

CVE-2026-92449

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value re

历史摘要 · 未重新核验 · NVD

#cve #cwe-129 #cwe-457 #cwe-787

漏洞预警2026-10-20 发布INFO

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is ...

CVE-2026-92446

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BI

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configu...

CVE-2026-92162

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from t...

CVE-2026-91189

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph`

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-680 #cwe-787

漏洞预警2026-10-20 发布INFO

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR...

CVE-2026-91186

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has al

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-787

漏洞预警2026-10-20 发布INFO

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output...

CVE-2026-91059

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header aft

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file c...

CVE-2026-113466

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-320 #cwe-321

漏洞预警2026-10-20 发布INFO

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open H...

CVE-2026-113411

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-939

漏洞预警2026-10-20 发布INFO

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of th...

CVE-2026-113397

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function rueques

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-10-20 发布INFO

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus i...

CVE-2026-112944

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-10-20 发布INFO

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. Wh...

CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did no

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argume...

CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middle

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree...

CVE-2026-112941

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWrit

历史摘要 · 未重新核验 · NVD

#cve #cwe-367