2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-29 发布MEDIUM

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedde...

CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (E

来源摘录 · NVD

#cve #cwe-538

漏洞预警2026-10-29 发布MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who co...

CVE-2026-115706

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escal

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing re...

CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly re

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布INFO

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management int...

CVE-2026-114358

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布HIGH

Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113143

Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafte

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-29 发布INFO

Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL.

CVE-2026-107024

Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite anot

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

CVE-2026-107023

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrari

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards acro...

CVE-2026-107021

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows u

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.

CVE-2026-107020

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries ...

CVE-2026-107019

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthori

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.

CVE-2026-107018

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read a

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated...

CVE-2026-107017

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers t

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.

CVE-2026-107016

Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.

CVE-2026-107015

Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in anot

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

CVE-2026-107014

Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read no

来源摘录 · NVD

#cve

漏洞预警2026-10-13 发布HIGH

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approva...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emerge

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-29 发布HIGH

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory ...

CVE-2026-103665

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Librari

来源摘录 · NVD

#cve #cwe-427

漏洞预警2026-10-14 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTool...

CVE-2026-101897

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

来源摘录 · NVD

#cve #cwe-346 #cwe-441 #cwe-940

漏洞预警2026-10-14 发布MEDIUM

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscription...

CVE-2026-100404

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new mess

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-14 发布MEDIUM

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesenti...

CVE-2026-100394

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11,

来源摘录 · NVD

#cve #cwe-362 #cwe-476