2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-25 发布MEDIUM

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attacke...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory acco

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-26 发布MEDIUM

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk ...

CVE-2026-84496

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2,

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-25 发布HIGH

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums fro

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-25 发布LOW

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to differen...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-26 发布HIGH

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevat...

CVE-2026-65327

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, m

来源摘录 · NVD

#cve #cwe-693

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate param...

CVE-2026-116891

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed proper...

CVE-2026-116889

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with pa

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unesca...

CVE-2026-116888

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with th

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布HIGH

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issu...

CVE-2026-96521

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allo...

CVE-2026-116884

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, del...

CVE-2026-116875

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-26 发布HIGH

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a mal...

CVE-2026-86929

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, m

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped d...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may...

CVE-2026-97045

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integra

来源摘录 · NVD

#cve

漏洞预警2026-10-27 发布INFO

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the ac...

CVE-2026-78661

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string con

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布HIGH

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0...

CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Ass

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1327

漏洞预警2026-10-28 发布HIGH

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `versi...

CVE-2026-59176

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-829

漏洞预警2026-10-28 发布HIGH

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authoriz...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-27 发布HIGH

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a conf...

CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` un

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-27 发布MEDIUM

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads ...

CVE-2026-58496

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's

来源摘录 · NVD

#cve #cwe-125