2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-08-14 发布HIGH

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

CVE-2026-69414

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl

来源摘录 · NVD

#cve #cwe-269 #cwe-59

漏洞预警2026-10-28 发布HIGH

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mod...

CVE-2026-61542

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem,

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-28 发布MEDIUM

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-contr...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /f

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-07-14 发布HIGH

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-57108

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny servi

来源摘录 · NVD

#cve #cwe-843

漏洞预警2026-10-15 发布HIGH

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to...

CVE-2026-55587

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser ext

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-15 发布MEDIUM

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3...

CVE-2026-54683

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom

来源摘录 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-10-28 发布MEDIUM

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the ...

CVE-2026-54162

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row f

来源摘录 · NVD

#cve #cwe-150

漏洞预警2026-10-23 发布HIGH

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted intern...

CVE-2026-50053

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* t

来源摘录 · NVD

#cve #cwe-642

漏洞预警2026-10-23 发布INFO

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inse...

CVE-2026-4952

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布INFO

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The sear...

CVE-2026-4951

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for emplo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布INFO

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties,...

CVE-2026-4950

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the emplo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-08-11 发布MEDIUM

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

CVE-2026-40375

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布HIGH

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially craft...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unaut

来源摘录 · NVD

#cve #cwe-611

漏洞预警2026-10-28 发布HIGH

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `...

CVE-2026-13451

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:high

漏洞预警2026-10-23 发布MEDIUM

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revok...

CVE-2026-115786

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume ano

来源摘录 · NVD

#cve #cwe-682

漏洞预警2026-10-28 发布MEDIUM

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environ...

CVE-2026-115415

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 mig

来源摘录 · NVD

#cve

漏洞预警2026-10-21 发布MEDIUM

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signe...

CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-23 发布INFO

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain...

CVE-2026-114357

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmwa

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-23 发布INFO

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with n...

CVE-2026-114356

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 thro

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-23 发布INFO

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process ...

CVE-2026-114355

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through

来源摘录 · NVD

#cve #cwe-78