2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-20 发布MEDIUM

A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lea...

CVE-2026-113705

A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file

来源摘录 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-28 发布HIGH

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer ...

CVE-2026-112357

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local pri

来源摘录 · NVD

#cve #cwe-276

漏洞预警2026-10-28 发布MEDIUM

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-19 发布INFO

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticate...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-28 发布HIGH

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing ...

CVE-2026-111120

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-19 发布INFO

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An...

CVE-2026-111064

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handl

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-16 发布HIGH

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-cl...

CVE-2026-111044

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布MEDIUM

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions u...

CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPres

来源摘录 · NVD

#cve #cwe-98

漏洞预警2026-10-28 发布MEDIUM

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. ...

CVE-2026-109980

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all version...

CVE-2026-107710

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Sc

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布MEDIUM

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Con...

CVE-2021-48020

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-21 发布LOW

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. M...

CVE-2020-37289

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-20 发布HIGH

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Atta...

CVE-2016-20103

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via Cand...

CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allow

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust ...

CVE-2026-116173

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate Engi

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs ...

CVE-2026-116174

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and Generat

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布MEDIUM

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration ...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path call

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-25 发布HIGH

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-R...

CVE-2026-116176

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outb

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布HIGH

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner le...

CVE-2026-116180

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-25 发布MEDIUM

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipa...

CVE-2026-116187

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows a

来源摘录 · NVD

#cve #cwe-639