2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-15 发布MEDIUM

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth stat...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an auth

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-15 发布MEDIUM

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with ...

CVE-2026-57183

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-19 发布MEDIUM

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected reso...

CVE-2025-7043

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid ac

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-23 发布INFO

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that ex...

CVE-2025-30047

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an H

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-28 发布LOW

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter ...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-288 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently r...

CVE-2026-118677

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop ap

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-939 #severity:medium

漏洞预警2026-03-27 发布MEDIUM

Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This issue affects pnGate: through 1.30 epGate: through 1.30 mb...

CVE-2023-7339

Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This i

来源摘录 · NVD

#cve #cwe-121

漏洞预警2025-10-14 发布HIGH

A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 ...

CVE-2023-46718

A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through

来源摘录 · NVD

#cve #cwe-121

漏洞预警2023-02-16 发布HIGH

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands...

CVE-2023-23783

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions

来源摘录 · NVD

#cve #cwe-134

漏洞预警2026-10-27 发布MEDIUM

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, ...

CVE-2026-103359

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming pay

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-27 发布MEDIUM

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation se...

CVE-2026-103332

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of i

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-28 发布MEDIUM

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against...

CVE-2026-103331

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of pay

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-28 发布MEDIUM

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirm...

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confi

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-27 发布HIGH

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an ...

CVE-2026-57202

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2

来源摘录 · NVD

#cve #cwe-1220 #cwe-267

漏洞预警2026-10-27 发布INFO

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the...

CVE-2026-57190

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布INFO

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `...

CVE-2026-57189

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated atta

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-27 发布HIGH

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_o...

CVE-2026-57186

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10

来源摘录 · NVD

#cve #cwe-839

漏洞预警2026-10-28 发布MEDIUM

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers...

CVE-2026-118376

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-p

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session...

CVE-2026-106079

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessMan

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure an...

CVE-2026-103411

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker wit

来源摘录 · NVD

#cve #cwe-191