2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-26 发布MEDIUM

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS...

CVE-2026-112455

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects Bu...

CVE-2026-111850

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-08 发布MEDIUM

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authen...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when acces

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-14 发布MEDIUM

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them...

CVE-2026-104109

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0,

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-14 发布MEDIUM

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in developm...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.9

来源摘录 · NVD

#cve #cwe-345 #cwe-770 #cwe-862

漏洞预警2026-10-14 发布INFO

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seawe...

CVE-2026-100413

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-15 发布HIGH

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a...

CVE-2026-100353

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths t

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-29 发布HIGH

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets...

CVE-2019-25781

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows r

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-22 发布HIGH

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to ...

CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 a

来源摘录 · NVD

#cve #cwe-1385 #cwe-346

漏洞预警2026-10-22 发布MEDIUM

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-...

CVE-2026-114348

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 bef

来源摘录 · NVD

#cve #cwe-1289 #cwe-209

漏洞预警2026-09-23 发布HIGH

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. T...

CVE-2026-96889

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-09-23 发布HIGH

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time eva...

CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps th

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-09-20 发布HIGH

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated...

CVE-2026-94109

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerP

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the resp...

CVE-2026-93008

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME targ

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open ...

CVE-2026-93007

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive t

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on...

CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is

来源摘录 · NVD

#cve #cwe-672

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Eas...

CVE-2026-91476

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcureme

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-20 发布LOW

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affecte...

CVE-2026-91400

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-23 发布MEDIUM

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfis

来源摘录 · NVD

#cve #cwe-1287

漏洞预警2026-10-29 发布MEDIUM

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of K...

CVE-2026-88941

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerabil

来源摘录 · NVD

#cve #cwe-306