2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-27 发布MEDIUM

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabl...

CVE-2026-116679

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deploy

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-27 发布INFO

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active do...

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布LOW

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in ...

CVE-2026-116673

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) im

来源摘录 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-21 发布HIGH

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted pres...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to inst

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo,...

CVE-2026-114398

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HT

来源摘录 · NVD

#cve #cwe-434

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and P...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify ticke

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to mo...

CVE-2026-114388

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in Gr

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_...

CVE-2026-114256

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. A

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布MEDIUM

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file i...

CVE-2026-114253

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. T

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布MEDIUM

A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/cu...

CVE-2026-114250

A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This is

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布HIGH

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by th...

CVE-2026-114243

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布MEDIUM

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-by...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-21 发布HIGH

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts en...

CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry na...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-21 发布MEDIUM

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-21 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop ...

CVE-2026-113793

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF t

来源摘录 · NVD

#cve #cwe-835

漏洞预警2026-10-21 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retriev...

CVE-2026-113789

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large

来源摘录 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-20 发布MEDIUM

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is ...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-27 发布HIGH

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScr...

CVE-2026-112353

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webma

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-20 发布HIGH

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) w...

CVE-2026-111758

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference d

来源摘录 · NVD

#cve #cwe-400 #cwe-407