2026-10-23 归档

今日共收录 1236 条安全情报，包含 262 个 CVE，575 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-21 发布INFO

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this polic...

CVE-2026-105933

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting

历史摘要 · 未重新核验 · NVD

#cve #cwe-636

漏洞预警2026-10-21 发布INFO

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check th...

CVE-2026-105932

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy o

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection a...

CVE-2025-55702

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-10-21 发布INFO

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including ...

CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-10-21 发布INFO

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affect...

CVE-2026-92210

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of N...

CVE-2026-92209

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-331

漏洞预警2026-10-21 发布INFO

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected install...

CVE-2026-92208

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacen

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-21 发布INFO

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installati...

CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote a

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbi...

CVE-2026-92204

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate ar...

CVE-2026-92203

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff...

CVE-2026-92202

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-10-21 发布INFO

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa...

CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-21 发布INFO

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can ...

CVE-2026-114493

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attack...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG conten

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布INFO

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRo...

CVE-2026-114176

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response ...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer seriali

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regu...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-21 发布INFO

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML ...

CVE-2026-114128

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within ...

CVE-2026-114127

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS ge

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook develo...

CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94 #cwe-306