2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-20 发布LOW

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. ...

CVE-2026-91330

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su

来源摘录 · NVD

#cve #cwe-404

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. ...

CVE-2026-91329

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布HIGH

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily ...

CVE-2026-91328

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-20 发布HIGH

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. ...

CVE-2026-91327

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布HIGH

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. ...

CVE-2026-91326

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-28 发布HIGH

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to...

CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmars

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-28 发布MEDIUM

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in throug...

CVE-2026-79656

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-28 发布MEDIUM

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker ...

CVE-2026-58458

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-28 发布HIGH

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching thr...

CVE-2026-116795

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1333 #cwe-407

漏洞预警2026-10-28 发布INFO

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path ...

CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 un

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authentic...

CVE-2026-115281

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute bef

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布MEDIUM

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress...

CVE-2026-115255

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, a

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-28 发布MEDIUM

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing un...

CVE-2026-115225

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group l

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布MEDIUM

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating req...

CVE-2026-115224

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popu

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布MEDIUM

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its templa...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being store

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-21 发布MEDIUM

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attack...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG conten

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布MEDIUM

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the compon...

CVE-2026-114265

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布HIGH

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController...

CVE-2026-114262

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the funct

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-21 发布HIGH

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. E...

CVE-2026-114259

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affec

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-21 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response ...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer seriali

来源摘录 · NVD

#cve #cwe-79