2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-27 发布INFO

NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema...

CVE-2026-118132

NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsa

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of ...

CVE-2026-118131

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inher

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the a...

CVE-2026-117526

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-27 发布INFO

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Ha...

CVE-2026-117516

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-27 发布INFO

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication....

CVE-2026-117515

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impa

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-27 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves sy...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-27 发布INFO

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, ...

CVE-2026-116680

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-27 发布INFO

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabl...

CVE-2026-116679

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deploy

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-27 发布INFO

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes...

CVE-2026-116678

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader v

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-27 发布INFO

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/...

CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI manage

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-contr...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布INFO

Tanium addressed a compression bomb vulnerability in Enforce.

CVE-2026-116662

Tanium addressed a compression bomb vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-27 发布INFO

Tanium addressed an improper access controls vulnerability in Enforce.

CVE-2026-116660

Tanium addressed an improper access controls vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVE-2026-116659

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-27 发布INFO

Tanium addressed a denial of service vulnerability in Enforce.

CVE-2026-116658

Tanium addressed a denial of service vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-27 发布INFO

Tanium addressed a denial of service vulnerability in Enforce.

CVE-2026-116657

Tanium addressed a denial of service vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-27 发布INFO

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVE-2026-116656

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-27 发布INFO

Tanium addressed an improper output sanitization vulnerability in Enforce.

CVE-2026-116649

Tanium addressed an improper output sanitization vulnerability in Enforce.

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-10-27 发布INFO

Tanium addressed an improper output sanitization vulnerability in Comply.

CVE-2026-116647

Tanium addressed an improper output sanitization vulnerability in Comply.

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-10-27 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-112374. Reason: This candidate is a duplicate of CVE-2026-112374. Notes: All CVE users shoul...

CVE-2026-111054

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-112374. Reason: This candidate is a

历史摘要 · 未重新核验 · NVD

#cve