2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-13 发布HIGH

Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-70068

Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privi

来源摘录 · NVD

#cve #cwe-122 #cwe-822

漏洞预警2026-10-13 发布HIGH

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

CVE-2026-70069

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-10-13 发布MEDIUM

Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network.

CVE-2026-70072

Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service o

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-13 发布MEDIUM

Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2026-70075

Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an autho

来源摘录 · NVD

#cve #cwe-367

漏洞预警2026-10-13 发布HIGH

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVE-2026-70076

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布MEDIUM

Use after free in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2026-70077

Use after free in Windows Kernel allows an authorized attacker to disclose information locally.

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布MEDIUM

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.

CVE-2026-70084

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布HIGH

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-70086

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布HIGH

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.

CVE-2026-70089

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-13 发布MEDIUM

Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

CVE-2026-70090

Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-20 发布MEDIUM

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a p...

CVE-2026-112911

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.

来源摘录 · NVD

#cve #cwe-283

漏洞预警2026-10-19 发布MEDIUM

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdat...

CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.q

来源摘录 · NVD

#cve #cwe-457

漏洞预警2026-10-19 发布HIGH

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, ...

CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType r

来源摘录 · NVD

#cve #cwe-457 #cwe-763

漏洞预警2026-10-19 发布HIGH

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA u...

CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond ro

来源摘录 · NVD

#cve #cwe-126

漏洞预警2026-10-19 发布HIGH

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check...

CVE-2026-112399

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-19 发布HIGH

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff ca...

CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer w

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-09-25 发布MEDIUM

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and allocation failures, ...

CVE-2026-98114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl()

来源摘录 · NVD

#cve #cwe-252

漏洞预警2026-09-25 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_f...

CVE-2026-98116

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocat

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-13 发布HIGH

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.

CVE-2026-105733

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-09-25 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefiles_coherency() is being passed a point...

CVE-2026-98117

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Curren

来源摘录 · NVD

#cve #cwe-416