2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-27 发布MEDIUM

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo th...

CVE-2026-50571

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the inte

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disc...

CVE-2026-48380

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-28 发布LOW

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP UR...

CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.t...

CVE-2026-118275

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the

来源摘录 · NVD

#cve #cwe-400 #cwe-404

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/da...

CVE-2026-118272

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionE

来源摘录 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-27 发布MEDIUM

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the compone...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdat

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-10-28 发布HIGH

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more tha...

CVE-2026-117609

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attacker

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-10-28 发布MEDIUM

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAdd...

CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAd

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布HIGH

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction w...

CVE-2026-117601

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing ma

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-347 #pip #severity:critical

漏洞预警2026-10-27 发布HIGH

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the res...

CVE-2026-117568

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by s

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布HIGH

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool ...

CVE-2026-117560

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attacker

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布MEDIUM

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to comp...

CVE-2026-117556

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes t

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-27 发布HIGH

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication....

CVE-2026-117515

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impa

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-27 发布HIGH

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument em...

CVE-2026-117512

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-27 发布MEDIUM

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persi...

CVE-2026-117509

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of th

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-27 发布MEDIUM

A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipula...

CVE-2026-117505

A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue

来源摘录 · NVD

#cve #cwe-400 #cwe-404

漏洞预警2026-10-27 发布MEDIUM

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_...

CVE-2026-116774

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65

来源摘录 · NVD

#cve #cwe-400 #cwe-835

漏洞预警2026-10-27 发布INFO

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-...

CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in o

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-27 发布HIGH

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_ver...

CVE-2026-116690

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSession...

CVE-2026-116686

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

#cve #cwe-918