2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-28 发布HIGH

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used b...

CVE-2026-93523

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server b

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-122

漏洞预警2026-10-28 发布HIGH

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X ...

CVE-2026-93522

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-122

漏洞预警2026-10-28 发布HIGH

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execu...

CVE-2026-93521

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 c

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-122

漏洞预警2026-10-28 发布INFO

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in...

CVE-2026-86983

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API withou

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attac...

CVE-2026-83525

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 be

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-480

漏洞预警2026-10-28 发布MEDIUM

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it ...

CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-dec

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-943

漏洞预警2026-10-28 发布HIGH

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifi...

CVE-2026-118510

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the ab

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-843

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, ...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the fil

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-prox...

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read perm

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in indep...

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing object

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scrip...

CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar over

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site ...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespons

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-sit...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace brow

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by adm...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, ...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, includ

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resultin...

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not ch

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only befor

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permissi...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validatin

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Confi...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being re

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布INFO

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin withou...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launc

来源摘录 · NVD

#cve