2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-27 发布INFO

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that sp...

CVE-2026-117341

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. Wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, li...

CVE-2026-116900

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article ...

CVE-2026-116899

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices i

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authen...

CVE-2026-116898

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布INFO

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or cl...

CVE-2026-116897

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] ...

CVE-2026-116896

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. A...

CVE-2026-116895

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in k...

CVE-2026-116894

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account a

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-27 发布INFO

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid ...

CVE-2026-116893

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets n

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search param...

CVE-2026-116892

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate param...

CVE-2026-116891

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only m...

CVE-2026-116890

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed proper...

CVE-2026-116889

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unesca...

CVE-2026-116888

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with th

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed prop...

CVE-2026-116887

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with p

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier...

CVE-2026-116886

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with p

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inj...

CVE-2026-116885

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdm

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allo...

CVE-2026-116884

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptio...

CVE-2026-116883

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through Facete...

CVE-2026-116882

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79