2026-10-29 归档

今日共收录 3209 条安全情报,包含 2330 个 CVE,388 篇安全通告,以及 93 篇研究论文。

← 返回归档列表
漏洞预警2026-10-23 发布INFO

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUt...

CVE-2026-54668

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. P

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium sec...

CVE-2026-118322

Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium secu...

CVE-2026-118319

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory i

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a cra

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the sy...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and ac

来源摘录 · NVD

漏洞预警2026-10-29 发布INFO

Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-roots" include a ...

CVE-2026-117611

Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority st

来源摘录 · NVD

漏洞预警2026-10-24 发布MEDIUM

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying...

CVE-2026-116010

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write reco

来源摘录 · NVD

漏洞预警2026-10-23 发布INFO

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-typ...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stre

来源摘录 · NVD

漏洞预警2026-10-23 发布INFO

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard i...

CVE-2026-115885

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --ver

来源摘录 · NVD

漏洞预警2026-10-23 发布MEDIUM

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an ...

CVE-2026-115877

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.

来源摘录 · NVD

漏洞预警2026-10-23 发布HIGH

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to is...

CVE-2026-115810

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows aut

来源摘录 · NVD

漏洞预警2026-10-24 发布MEDIUM

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. T...

CVE-2026-115802

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/Aut

来源摘录 · NVD

漏洞预警2026-10-23 发布LOW

A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_...

CVE-2026-115797

A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management

来源摘录 · NVD

漏洞预警2026-10-23 发布MEDIUM

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNested...

CVE-2026-115774

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deploym...

CVE-2026-115713

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Con...

CVE-2026-115712

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-le

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedd...

CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (E

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other...

CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the confi...

CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to au

来源摘录 · NVD