2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-08-31 发布HIGH

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

CVE-2026-83596

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handl

来源摘录 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布HIGH

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

CVE-2026-78376

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-08-11 发布HIGH

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink...

CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-28 发布MEDIUM

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_qu...

CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI`

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, ...

CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after o...

CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/func

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `v...

CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control

来源摘录 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Str...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passe

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布INFO

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_ser...

CVE-2026-61546

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard appli

来源摘录 · NVD

#cve #cwe-346 #cwe-350

漏洞预警2026-10-28 发布INFO

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `...

CVE-2026-57448

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the adm

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `ho...

CVE-2026-54455

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

来源摘录 · NVD

#cve #cwe-20 #cwe-89

漏洞预警2026-10-28 发布HIGH

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration ...

CVE-2026-54453

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

来源摘录 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-28 发布HIGH

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post...

CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862 #severity:high

漏洞预警2026-10-28 发布HIGH

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_r...

CVE-2026-118803

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1336 #severity:high

漏洞预警2026-10-28 发布MEDIUM

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthe...

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerab

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ ent...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-28 发布HIGH

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder pa...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticate

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-78 #severity:high

漏洞预警2026-10-28 发布MEDIUM

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished dra...

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862 #severity:medium

漏洞预警2026-10-28 发布HIGH

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GI...

CVE-2026-118753

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attac

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-787 #severity:high

漏洞预警2026-10-28 发布HIGH

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attacker...

CVE-2026-118752

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIF

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-787 #severity:high