2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-23 发布MEDIUM

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-23 发布MEDIUM

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file app...

CVE-2026-115536

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Th

来源摘录 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-22 发布MEDIUM

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership che...

CVE-2026-115509

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or...

CVE-2026-115505

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-23 发布MEDIUM

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to...

CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data wi

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-22 发布MEDIUM

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limi...

CVE-2026-115397

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFold

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布LOW

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validat...

CVE-2026-115393

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-22 发布LOW

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed ...

CVE-2026-115389

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-26 发布HIGH

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, mac...

CVE-2026-113912

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26

来源摘录 · NVD

#cve #cwe-125 #cwe-787

漏洞预警2026-10-26 发布MEDIUM

An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to ...

CVE-2026-112616

An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macO

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauth...

CVE-2026-111419

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains thi

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-29 发布HIGH

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions...

CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布HIGH

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. ...

CVE-2026-111417

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the u

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-18 发布MEDIUM

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in us...

CVE-2026-107686

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users w

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-14 发布MEDIUM

An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory ...

CVE-2026-101974

An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evo

来源摘录 · NVD

#cve #cwe-1284

漏洞预警2026-10-16 发布MEDIUM

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string p...

CVE-2025-52097

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary c

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-22 发布HIGH

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in...

CVE-2026-61791

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

来源摘录 · NVD

#cve #cwe-83

漏洞预警2026-06-17 发布HIGH

Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before...

CVE-2026-25439

Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentic

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-29 发布HIGH

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescape...

CVE-2026-119027

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl

来源摘录 · NVD

#cve #cwe-94