2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other...

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presi...

CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a for...

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /...

CVE-2026-114065

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-21 发布INFO

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, incl...

CVE-2026-114064

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows su

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read fi...

CVE-2026-114063

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redi...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach intern

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted wit...

CVE-2026-114061

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cach

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. At...

CVE-2026-114060

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-21 发布INFO

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because G...

CVE-2026-114059

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-o

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metada...

CVE-2026-114058

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that let

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. ...

CVE-2026-114057

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-...

CVE-2026-114055

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布INFO

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF Im...

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache k

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-21 发布INFO

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revisio...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProces

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-21 发布INFO

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_proce...

CVE-2026-114052

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布INFO

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught ...

CVE-2026-114051

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-10-21 发布INFO

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers ...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-21 发布INFO

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_id...

CVE-2026-114049

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain

历史摘要 · 未重新核验 · NVD

#cve #cwe-440

漏洞预警2026-10-21 发布INFO

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Att...

CVE-2026-114048

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-352