2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-28 发布HIGH

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/D...

CVE-2026-52729

Xibo is an open source digital signage platform with a web content management system and Windows display player software

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /...

CVE-2026-50541

Xibo is an open source digital signage platform with a web content management system and Windows display player software

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-27 发布INFO

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While thi...

CVE-2026-22063

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布HIGH

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extra...

CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-24

漏洞预警2026-10-28 发布MEDIUM

Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

CVE-2026-118435

Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-28 发布HIGH

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unve...

CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthentica

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-27 发布INFO

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes c...

CVE-2026-118173

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for requ

来源摘录 · NVD

#cve #cwe-20 #cwe-285

漏洞预警2026-10-27 发布INFO

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redir...

CVE-2026-118172

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect

来源摘录 · NVD

#cve

漏洞预警2026-10-27 发布INFO

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs...

CVE-2026-118171

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. T

来源摘录 · NVD

#cve

漏洞预警2026-10-27 发布INFO

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update righ...

CVE-2026-118170

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made w

来源摘录 · NVD

#cve

漏洞预警2026-10-27 发布INFO

NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema...

CVE-2026-118132

NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsa

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布MEDIUM

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header f...

CVE-2026-117608

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers t

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-28 发布HIGH

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted lang...

CVE-2026-117607

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with

来源摘录 · NVD

#cve #cwe-434

漏洞预警2026-10-27 发布INFO

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash...

CVE-2026-116695

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectl

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-436 #rubygems #severity:medium

漏洞预警2026-10-27 发布INFO

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on a...

CVE-2026-116693

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QU

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-27 发布MEDIUM

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked wit...

CVE-2026-116689

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, strea...

CVE-2026-116685

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-27 发布INFO

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or r...

CVE-2026-116683

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-27 发布HIGH

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves sy...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand

来源摘录 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-27 发布MEDIUM

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, ...

CVE-2026-116680

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs wi

来源摘录 · NVD

#cve #cwe-918