2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-20 发布INFO

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

CVE-2026-43834

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-20 发布INFO

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database c...

CVE-2026-113407

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database c...

CVE-2026-113406

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database c...

CVE-2026-113405

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving pr...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitte

历史摘要 · 未重新核验 · NVD

#cve #cwe-648

漏洞预警2026-10-20 发布INFO

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield serv...

CVE-2026-111090

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-20 发布INFO

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attac...

CVE-2024-2323

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-20 发布INFO

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insuffi...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious se...

CVE-2026-113404

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-20 发布INFO

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, th...

CVE-2026-113403

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-10-20 发布INFO

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to...

CVE-2026-113402

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-10-20 发布INFO

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScr...

CVE-2026-112148

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(),...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-41 #cwe-116

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-172 #cwe-180

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for H...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-436

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() a...

CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-41

漏洞预警2026-10-20 发布INFO

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator pr...

CVE-2026-97627

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use

历史摘要 · 未重新核验 · NVD

#cve #cwe-912

漏洞预警2026-10-20 发布INFO

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticate...

CVE-2026-96903

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contac

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read de...

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public R

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient es...

CVE-2026-93300

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-89