2026-10-29 归档

今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-10-21 发布MEDIUM

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-meta...

CVE-2026-114374

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file inte

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in ...

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-21 发布HIGH

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in

来源摘录 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-16 发布MEDIUM

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/...

CVE-2026-102923

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-22 发布MEDIUM

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /con...

CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipu...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-03-27 发布MEDIUM

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers ...

CVE-2023-7340

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed

来源摘录 · NVD

#cve #cwe-125

漏洞预警2025-12-31 发布INFO

PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can re...

CVE-2023-7332

PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handl

来源摘录 · NVD

#cve #cwe-1284

漏洞预警2025-12-31 发布MEDIUM

A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerability affects unknown code of the component User Handler. ...

CVE-2023-7331

A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerabi

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2025-10-29 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds ...

CVE-2023-7324

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds

来源摘录 · NVD

#cve

漏洞预警2026-04-16 发布MEDIUM

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.

CVE-2023-5872

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames th

来源摘录 · NVD

#cve #cwe-203

漏洞预警2026-07-18 发布HIGH

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Att...

CVE-2023-54366

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELE

来源摘录 · NVD

#cve #cwe-276

漏洞预警2026-06-19 发布HIGH

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserDat...

CVE-2023-54357

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-203

漏洞预警2026-05-05 发布MEDIUM

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the sea...

CVE-2023-54349

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-05-05 发布HIGH

ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation ...

CVE-2023-54348

ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas

来源摘录 · NVD

#cve #cwe-1236

漏洞预警2026-05-05 发布HIGH

OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login...

CVE-2023-54347

OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protect

来源摘录 · NVD

#cve #cwe-307

漏洞预警2026-05-05 发布HIGH

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing...

CVE-2023-54346

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated att

来源摘录 · NVD

#cve #cwe-538

漏洞预警2026-05-05 发布HIGH

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by...

CVE-2023-54345

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated us

来源摘录 · NVD

#cve #cwe-94

漏洞预警2025-12-30 发布INFO

In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entri...

CVE-2023-54322

In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry a

来源摘录 · NVD

#cve

漏洞预警2025-12-30 发布INFO

In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning The failover txq is inited as 16 queues. when a packet is trans...

CVE-2023-54236

In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning The fa

来源摘录 · NVD

#cve