2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-29 发布INFO

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow rem...

CVE-2025-62841

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Bac

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-29 发布INFO

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow rem...

CVE-2025-62839

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Bac

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they a...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over p...

CVE-2026-118657

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers fr

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path s...

CVE-2026-118656

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently...

CVE-2026-118655

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path

来源摘录 · NVD

#cve #cwe-174

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route...

CVE-2026-118654

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after rout

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the defa...

CVE-2026-118653

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Re

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that pas...

CVE-2026-118652

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated ca

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExt...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP hea

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as th

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead ...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-sup

来源摘录 · NVD

#cve #cwe-348

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture li...

CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error

来源摘录 · NVD

#cve #cwe-252

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client d...

CVE-2026-118262

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy gorou

来源摘录 · NVD

#cve #cwe-772

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small com...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded reque

来源摘录 · NVD

#cve #cwe-400 #cwe-409

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete resp...

CVE-2026-118260

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-29 发布MEDIUM

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read produ...

CVE-2026-114173

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefron

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-201 #severity:medium

漏洞预警2026-10-29 发布MEDIUM

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the...

CVE-2026-113409

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to store

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-29 发布HIGH

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secre

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-306 #severity:high

漏洞预警2026-10-28 发布INFO

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, ad...

CVE-2026-117501

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-770