2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-21 发布CRITICAL

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software...

CVE-2026-76527

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive int

来源摘录 · NVD

#cve #cwe-703

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVE-2026-62017

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

CVE-2026-62012

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

CVE-2026-62006

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

CVE-2026-62001

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

CVE-2026-54858

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-23 发布CRITICAL

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSo...

CVE-2026-46651

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.0

来源摘录 · NVD

#cve #cwe-306 #cwe-552 #cwe-918

漏洞预警2026-10-28 发布CRITICAL

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs end...

CVE-2026-118690

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attacke

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-28 发布CRITICAL

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipu...

CVE-2026-118579

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark

来源摘录 · NVD

#cve #cwe-912

漏洞预警2026-10-20 发布CRITICAL

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

CVE-2026-113399

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-27 发布CRITICAL

Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pa...

CVE-2026-118316

Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-27 发布CRITICAL

Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

CVE-2026-118321

Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to pot

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-27 发布CRITICAL

Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafte...

CVE-2026-118332

Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentiall

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-27 发布CRITICAL

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (C...

CVE-2026-118340

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-27 发布CRITICAL

Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pag...

CVE-2026-118342

Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-27 发布CRITICAL

Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HT...

CVE-2026-118355

Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially ex

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-20 发布CRITICAL

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...

CVE-2026-91218

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-29 发布CRITICAL

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing...

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handl

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-29 发布CRITICAL

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write ...

CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml wo

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-19 发布CRITICAL

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class nam...

CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in

来源摘录 · NVD

#cve #cwe-401