2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-28 发布INFO

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script...

CVE-2026-107625

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布INFO

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerabil...

CVE-2026-105272

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper us

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-28 发布INFO

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default....

CVE-2015-20129

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrativ

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-28 发布INFO

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields....

CVE-2014-125138

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-28 发布INFO

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.p...

CVE-2014-125137

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-10-28 发布INFO

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in ...

CVE-2014-125136

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information d

历史摘要 · 未重新核验 · NVD

#cve #cwe-530

漏洞预警2026-10-28 发布INFO

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup...

CVE-2013-20009

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布INFO

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Atta...

CVE-2013-20008

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administra

历史摘要 · 未重新核验 · NVD

#cve #cwe-620

漏洞预警2026-10-28 发布INFO

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into...

CVE-2013-20007

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布INFO

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/da...

CVE-2026-118272

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionE

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-28 发布INFO

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts ...

CVE-2026-118271

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-404

漏洞预警2026-10-28 发布INFO

ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using...

CVE-2026-110747

ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-28 发布INFO

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bo...

CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected elemen

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-28 发布INFO

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper...

CVE-2026-104895

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-28 发布INFO

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and th

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-27 发布INFO

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a conf...

CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` un

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-27 发布INFO

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads ...

CVE-2026-58496

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-27 发布INFO

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file ...

CVE-2026-58257

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the databa

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-27 发布INFO

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_e...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrat

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-862 #cwe-915

漏洞预警2026-10-27 发布INFO

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files r...

CVE-2026-58205

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` para

历史摘要 · 未重新核验 · NVD

#cve #cwe-79