2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attack...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the da

历史摘要 · 未重新核验 · NVD

#cve #cwe-363

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but ...

CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged proces

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, al...

CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to ...

CVE-2026-112936

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock v

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-668

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stal...

CVE-2026-112935

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename acce...

CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder reco

历史摘要 · 未重新核验 · NVD

#cve #cwe-62

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, a...

CVE-2026-112915

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLit

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local us...

CVE-2026-112914

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker

历史摘要 · 未重新核验 · NVD

#cve #cwe-363

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability ch...

CVE-2026-112912

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symb

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a p...

CVE-2026-112911

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.

历史摘要 · 未重新核验 · NVD

#cve #cwe-283

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual r...

CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file rename

历史摘要 · 未重新核验 · NVD

#cve #cwe-706

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and re...

CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can re

历史摘要 · 未重新核验 · NVD

#cve #cwe-694

漏洞预警2026-10-20 发布INFO

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.Thi...

CVE-2026-112834

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Store...

CVE-2026-112833

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously S

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/...

CVE-2026-111762

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequest

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-20 发布INFO

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPus...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSend

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-20 发布INFO

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and pars...

CVE-2026-96582

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host w

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-1285

漏洞预警2026-10-20 发布INFO

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and ...

CVE-2026-96406

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, f...

CVE-2026-93446

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-10-20 发布INFO

Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued...

CVE-2026-91041

Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-787 #cwe-1284