2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-29 发布HIGH

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers ...

CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布INFO

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accep...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certif

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-22 发布MEDIUM

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 C...

CVE-2026-115411

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivate

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-22 发布MEDIUM

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients ...

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布LOW

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers wi...

CVE-2026-115369

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a C

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布LOW

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanit...

CVE-2026-115363

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_

来源摘录 · NVD

#cve #cwe-212

漏洞预警2026-10-22 发布LOW

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded cert...

CVE-2026-115359

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fail

来源摘录 · NVD

#cve #cwe-799

漏洞预警2026-10-22 发布MEDIUM

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidate...

CVE-2026-115351

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-22 发布HIGH

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypa...

CVE-2026-115332

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布HIGH

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. A...

CVE-2026-115324

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attack

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布LOW

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server thro...

CVE-2026-115319

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-22 发布MEDIUM

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime....

CVE-2026-115249

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Im

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-22 发布LOW

A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg...

CVE-2026-115246

A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a2

来源摘录 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-22 发布INFO

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.lo...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布INFO

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there wi...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL fr

来源摘录 · NVD

#cve #cwe-305

漏洞预警2026-10-22 发布MEDIUM

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the...

CVE-2026-108360

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-863 #cwe-918

漏洞预警2026-10-22 发布INFO

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Re...

CVE-2026-108359

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-29 发布INFO

A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. ...

CVE-2026-105042

A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. Thi

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-29 发布INFO

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system t...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs(

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-22 发布MEDIUM

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imagePro...

CVE-2024-58394

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scri

来源摘录 · NVD

#cve #cwe-79