2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

← 返回归档列表

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error wor...

CVE-2026-118644

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-266 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, a...

CVE-2026-118643

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-209 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workf...

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoi...

CVE-2026-118641

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in th

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-943 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the ...

CVE-2026-118640

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布HIGH

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaini...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-35 #severity:critical

漏洞预警2026-10-28 发布MEDIUM

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceCont...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing tel

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布LOW

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language an...

CVE-2026-118258

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Pri

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-28 发布HIGH

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and even...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-116 #cwe-79

漏洞预警2026-10-28 发布INFO

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy AP...

CVE-2026-118256

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling esc

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-116 #cwe-79

漏洞预警2026-10-25 发布MEDIUM

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and m...

CVE-2026-116171

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows ex

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. A...

CVE-2026-114662

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated att

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-22 发布HIGH

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attack...

CVE-2026-114658

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-22 发布LOW

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round trip...

CVE-2026-114641

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend a

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-10-22 发布HIGH

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connect

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-22 发布MEDIUM

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can ...

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts t

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. ...

CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based AP

来源摘录 · NVD

#cve #cwe-1287 #cwe-287

漏洞预警2026-10-21 发布HIGH

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/tic...

CVE-2026-114440

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/del

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布MEDIUM

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argumen...

CVE-2026-114380

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布LOW

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go...

CVE-2026-114377

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio

来源摘录 · NVD

#cve #cwe-22