2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versio...

CVE-2026-119059

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capabi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, ...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inj

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient ...

CVE-2026-118634

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].cu...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post...

CVE-2026-118194

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inc

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-287 #severity:medium

漏洞预警2026-10-30 发布INFO

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could al...

CVE-2026-118165

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit a...

CVE-2026-118101

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to...

CVE-2026-118100

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before expor

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer det...

CVE-2026-118072

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to mana

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users w...

CVE-2026-118071

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an H

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege us...

CVE-2026-117572

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter befor

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and o...

CVE-2026-117571

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data der

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX...

CVE-2026-115277

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecti

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored m

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布MEDIUM

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary up...

CVE-2026-5461

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-73 #severity:medium

漏洞预警2026-10-30 发布HIGH

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of s...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #severity:high

漏洞预警2026-10-30 发布INFO

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

CVE-2026-118584

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Per

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863

漏洞预警2026-10-30 发布INFO

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue ...

CVE-2026-118574

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrect

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-732

漏洞预警2026-10-30 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affec...

CVE-2026-118576

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79

漏洞预警2026-10-30 发布INFO

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 t...

CVE-2026-96389

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit version

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862