2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-27 发布INFO

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117874

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, F

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Th...

CVE-2026-117873

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firef

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbir...

CVE-2026-117872

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 1

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117871

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 1

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117870

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Fire

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117869

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firef

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117868

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117867

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 1...

CVE-2026-117866

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117865

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderb

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117864

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbir

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird ...

CVE-2026-117863

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde...

CVE-2026-117862

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in F

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117861

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunder

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117860

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-27 发布INFO

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting...

CVE-2026-117603

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows mali

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-10-27 发布INFO

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the...

CVE-2026-117602

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-27 发布INFO

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction w...

CVE-2026-117601

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-27 发布INFO

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args paramete...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell co

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布INFO

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categ...

CVE-2026-117570

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-183