2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-20 发布INFO

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware ...

CVE-2026-10141

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-20 发布INFO

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request c...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-20 发布INFO

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP requ...

CVE-2026-10138

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HT...

CVE-2026-10137

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-20 发布INFO

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTT...

CVE-2026-10136

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-20 发布INFO

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can ...

CVE-2026-10135

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP reque...

CVE-2026-10133

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-20 发布INFO

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted H...

CVE-2026-10132

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLIN

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-20 发布INFO

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTT...

CVE-2026-10131

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's ot...

CVE-2026-112380

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-20 发布INFO

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for k...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-10-20 发布INFO

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values fro...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-10-20 发布INFO

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an...

CVE-2026-113672

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布INFO

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The mani...

CVE-2026-113506

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-20 发布INFO

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py ...

CVE-2026-113703

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where en

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-20 发布INFO

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host dir...

CVE-2026-113678

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-20 发布INFO

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next req...

CVE-2026-103119

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body

历史摘要 · 未重新核验 · NVD

#cve #cwe-127

漏洞预警2026-10-20 发布INFO

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between user...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlet

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-20 发布INFO

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its gro...

CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-20 发布INFO

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload En...

CVE-2026-113391

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77