2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-23 发布INFO

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts c...

CVE-2026-57210

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the

来源摘录 · NVD

#cve #cwe-116 #cwe-20 #cwe-290

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sa...

CVE-2026-57144

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbo

来源摘录 · NVD

#cve #cwe-266 #cwe-668 #cwe-693

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the appro...

CVE-2026-56840

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-...

CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its

来源摘录 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-23 发布MEDIUM

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly...

CVE-2026-55422

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two Re

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed valu...

CVE-2026-54631

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-07-30 发布LOW

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

CVE-2026-41709

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform

来源摘录 · NVD

#cve #cwe-778

漏洞预警2026-10-28 发布LOW

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. Thi...

CVE-2026-3583

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invali

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-613 #severity:low

漏洞预警2026-10-29 发布INFO

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-434 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacke...

CVE-2026-11854

The authentication endpoint generates an error message that includes reflected data directly from the request without su

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-29 发布INFO

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布HIGH

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chro...

CVE-2026-118359

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitra

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-27 发布HIGH

Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page....

CVE-2026-118358

Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute a

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-27 发布HIGH

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. ...

CVE-2026-118357

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute ar

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-27 发布HIGH

Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security ...

CVE-2026-118356

Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-27 发布HIGH

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML p...

CVE-2026-118354

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execu

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-27 发布HIGH

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit...

CVE-2026-118353

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insi

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-27 发布HIGH

Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (C...

CVE-2026-118352

Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbi

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-27 发布HIGH

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium secur...

CVE-2026-118351

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code in

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-27 发布HIGH

Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium secu...

CVE-2026-118350

Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code i

来源摘录 · NVD

#cve #cwe-416