Cyber Security Daily Radar

2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表
漏洞预警2026-10-16 发布HIGH

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Spa...

CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, St

来源摘录 · NVD

#cve#cwe-284#cwe-639#cwe-863
漏洞预警2026-10-16 发布MEDIUM

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into ...

CVE-2026-59962

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, pa

来源摘录 · NVD

#cve#cwe-943
漏洞预警2026-10-16 发布MEDIUM

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful M...

CVE-2026-57446

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Valu

来源摘录 · NVD

#cve#cwe-415#cwe-664#cwe-672
漏洞预警2026-10-16 发布INFO

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file ...

CVE-2026-55543

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path

来源摘录 · NVD

#cve#cwe-470#cwe-94
漏洞预警2026-10-28 发布HIGH

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBS...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-61#severity:high
漏洞预警2026-10-28 发布MEDIUM

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity J...

CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does n

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-441#severity:high
漏洞预警2026-10-28 发布HIGH

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling cons...

CVE-2026-118686

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1333#severity:high
漏洞预警2026-10-28 发布MEDIUM

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level s...

CVE-2026-118685

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the str

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布MEDIUM

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash t...

CVE-2026-118684

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns T

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-327#severity:high
漏洞预警2026-10-28 发布HIGH

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfi...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-94#severity:high
漏洞预警2026-10-28 发布MEDIUM

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBAL...

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-22#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Sla...

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-918#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows w...

CVE-2026-118678

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1321#severity:high
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node pa...

CVE-2026-118676

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use c

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-wor...

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared w

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__...

CVE-2026-118649

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner projec

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1321#severity:high
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error response...

CVE-2026-118648

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability be

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-79#severity:high
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw requ...

CVE-2026-118647

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error ex

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-532#severity:medium
漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob ...

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authen

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1333#severity:high
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base...

CVE-2026-118645

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-943#severity:high