2026-10-23 归档

今日共收录 1236 条安全情报，包含 262 个 CVE，575 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-22 发布INFO

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

CVE-2026-84913

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布INFO

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3....

CVE-2026-84912

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects A...

CVE-2026-84911

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布INFO

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

CVE-2026-84910

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Sear

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Lib...

CVE-2026-81163

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Imp

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布INFO

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versi...

CVE-2026-16648

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url(...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling o

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types fo...

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did ...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounc

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject an...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_send

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as hav...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserial

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the ...

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thum

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils

历史摘要 · 未重新核验 · NVD

#cve #cwe-669

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so...

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequence...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid para...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was c...

CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the passwo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forw...

CVE-2026-114717

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a messa

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken f...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_send

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the ...

CVE-2026-114715

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Mo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863