2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-08 发布LOW

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized...

CVE-2026-88648

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to by

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0...

CVE-2026-87373

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vu...

CVE-2026-87352

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versio

来源摘录 · NVD

#cve #cwe-284 #cwe-863

漏洞预警2026-10-26 发布MEDIUM

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able t...

CVE-2026-86925

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, ma

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to...

CVE-2026-86055

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds

来源摘录 · NVD

#cve #cwe-640

漏洞预警2026-10-29 发布LOW

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer ...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authenticatio

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-29 发布INFO

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘e...

CVE-2026-7190

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnera

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-09-22 发布HIGH

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Ja...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated

来源摘录 · NVD

#cve #cwe-184 #cwe-502

漏洞预警2026-10-23 发布MEDIUM

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled ...

CVE-2026-59188

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server

来源摘录 · NVD

#cve #cwe-434 #cwe-79

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get...

CVE-2026-56834

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discov

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-23 发布HIGH

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting ar...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and mod...

CVE-2026-49142

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that all

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.

CVE-2026-43840

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-10 发布HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from ...

CVE-2026-42693

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jan

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布HIGH

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with ...

CVE-2026-33924

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient va

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with adm...

CVE-2026-33923

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent valid

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-29 发布INFO

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

CVE-2026-21157

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activ

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-20 #severity:high

漏洞预警2026-10-29 发布MEDIUM

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to...

CVE-2026-118989

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the ma...

CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or adm

来源摘录 · NVD

#cve #cwe-620

漏洞预警2026-10-23 发布HIGH

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without...

CVE-2026-115726

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committin

来源摘录 · NVD

#cve #cwe-78