2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-26 发布MEDIUM

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequo...

CVE-2026-86920

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-09-08 发布HIGH

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document ...

CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providin

来源摘录 · NVD

#cve #cwe-763

漏洞预警2026-10-14 发布HIGH

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option who...

CVE-2026-73261

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TC

来源摘录 · NVD

#cve #cwe-125 #cwe-20

漏洞预警2026-10-29 发布MEDIUM

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified ...

CVE-2026-71569

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-26 发布MEDIUM

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS...

CVE-2026-65397

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-15 发布HIGH

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumReques...

CVE-2026-61611

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt

来源摘录 · NVD

#cve #cwe-307

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61 and 8.62. Difficult to e...

CVE-2026-60874

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

来源摘录 · NVD

#cve #cwe-284 #cwe-400

漏洞预警2026-10-29 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page ...

CVE-2026-5702

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticat

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5700

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5699

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5698

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5697

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布INFO

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded ...

CVE-2026-57209

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heim

来源摘录 · NVD

#cve #cwe-20 #cwe-74

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-d...

CVE-2026-57142

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a

来源摘录 · NVD

#cve #cwe-78 #cwe-863 #cwe-94

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again w...

CVE-2026-57114

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API valid

来源摘录 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explici...

CVE-2026-56838

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks

来源摘录 · NVD

#cve #cwe-693 #cwe-78 #cwe-863

漏洞预警2026-10-23 发布INFO

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event trackin...

CVE-2026-55826

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to befo

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-14 发布HIGH

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requ...

CVE-2026-55786

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /m

来源摘录 · NVD

#cve #cwe-306 #cwe-78

漏洞预警2026-10-23 发布MEDIUM

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket end...

CVE-2026-55463

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11

来源摘录 · NVD

#cve #cwe-1385 #cwe-306 #cwe-862

漏洞预警2026-10-23 发布MEDIUM

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strip...

CVE-2026-55442

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.0

来源摘录 · NVD

#cve #cwe-116 #cwe-20