2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values ren...

CVE-2026-116881

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated...

CVE-2026-116880

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates...

CVE-2026-116879

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplyin...

CVE-2026-116878

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anony

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by s...

CVE-2026-116877

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-p

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protec...

CVE-2026-116876

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, del...

CVE-2026-116875

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped d...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and ...

CVE-2026-116873

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to caus...

CVE-2026-116872

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_com

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-27 发布INFO

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth ...

CVE-2026-116871

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescr

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-27 发布INFO

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate ...

CVE-2026-116870

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in

历史摘要 · 未重新核验 · NVD

#cve #cwe-1289

漏洞预警2026-10-27 发布INFO

A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges...

CVE-2026-111548

A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-27 发布INFO

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because ...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-942

漏洞预警2026-10-27 发布INFO

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platf...

CVE-2026-85299

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布INFO

Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; Hi...

CVE-2026-82121

Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-27 发布INFO

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are ...

CVE-2026-117494

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code en...

CVE-2026-117493

Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP an...

CVE-2026-107147

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address h

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-27 发布INFO

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an atta...

CVE-2026-107146

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Du

历史摘要 · 未重新核验 · NVD

#cve #cwe-613