2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-20 发布INFO

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt...

CVE-2026-113583

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an u...

CVE-2026-113496

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured passw

历史摘要 · 未重新核验 · NVD

#cve #cwe-214

漏洞预警2026-10-20 发布INFO

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during ima...

CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command

历史摘要 · 未重新核验 · NVD

#cve #cwe-214

漏洞预警2026-10-20 发布INFO

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the compo...

CVE-2026-113388

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-20 发布INFO

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulati...

CVE-2026-113385

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Cla

历史摘要 · 未重新核验 · NVD

#cve #cwe-926

漏洞预警2026-10-20 发布INFO

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredH...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-20 发布INFO

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafka...

CVE-2026-105311

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custo

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-20 发布INFO

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deploym...

CVE-2026-9589

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead ...

CVE-2026-113384

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social.

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-20 发布INFO

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argumen...

CVE-2026-113383

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pag

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-20 发布INFO

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the...

CVE-2026-113382

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArch

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-20 发布INFO

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/...

CVE-2026-113358

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-20 发布INFO

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predicta...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hij

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed c...

CVE-2026-113356

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-20 发布INFO

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center ...

CVE-2026-113355

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/sys...

CVE-2026-113354

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permis

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-20 发布INFO

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instruc...

CVE-2026-113353

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor an

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept en...

CVE-2026-113352

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attacker...

CVE-2026-113351

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte c

历史摘要 · 未重新核验 · NVD

#cve #cwe-909

漏洞预警2026-10-20 发布INFO

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by U...

CVE-2026-113350

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts b

历史摘要 · 未重新核验 · NVD

#cve #cwe-79