2026-10-23 归档

今日共收录 1236 条安全情报，包含 262 个 CVE，575 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-21 发布INFO

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::V...

CVE-2026-112921

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher st

历史摘要 · 未重新核验 · NVD

#cve #cwe-488

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC p...

CVE-2026-96778

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/disp...

CVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif he...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the rema

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to ...

CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative...

CVE-2026-96641

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive g

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplica...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py tre

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to ...

CVE-2026-96638

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without r...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a l

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-409

漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DC

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-409

漏洞预警2026-10-21 发布INFO

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the cu...

CVE-2026-82987

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote,

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-21 发布INFO

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized P...

CVE-2026-29001

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achi

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-21 发布INFO

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signe...

CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-21 发布INFO

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argumen...

CVE-2026-114380

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布INFO

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controll...

CVE-2026-114379

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImage

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布INFO

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID re...

CVE-2026-114378

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布INFO

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go...

CVE-2026-114377

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodul...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js ...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dot...

CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every

历史摘要 · 未重新核验 · NVD

#cve #cwe-407