2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-28 发布MEDIUM

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, w...

CVE-2026-110509

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unaut

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password...

CVE-2026-110508

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement t

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布LOW

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are all...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, wh...

CVE-2026-110506

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before stori

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthent...

CVE-2026-110292

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooComm

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until ...

CVE-2026-110183

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaini

来源摘录 · NVD

#cve #cwe-202

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small en...

CVE-2026-110182

PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These f

来源摘录 · NVD

#cve #cwe-693

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration t...

CVE-2026-110181

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bo

来源摘录 · NVD

#cve #cwe-693

漏洞预警2026-10-28 发布MEDIUM

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated A...

CVE-2026-107100

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewa

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribut...

CVE-2026-107098

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's si

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscr...

CVE-2026-107097

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using t

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notif...

CVE-2026-106648

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substit

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-28 发布LOW

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storin...

CVE-2026-106647

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configur

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated...

CVE-2026-106003

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce valida

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-28 发布MEDIUM

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticat...

CVE-2026-106002

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing u...

CVE-2026-105997

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code email

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenti...

CVE-2026-105972

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVE-2026-105620

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymi

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVE-2026-105619

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Ano

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru ...

CVE-2026-105618

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to t

来源摘录 · NVD

#cve #cwe-862