2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-08-19 发布HIGH

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can brea

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布INFO

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

CVE-2026-21157

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activ

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-29 发布HIGH

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires exi...

CVE-2026-115805

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local use

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-78 #severity:high

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deploym...

CVE-2026-115713

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布MEDIUM

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedd...

CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (E

来源摘录 · NVD

#cve #cwe-538

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other...

CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the confi...

CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to au

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布MEDIUM

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedde...

CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (E

来源摘录 · NVD

#cve #cwe-538

漏洞预警2026-10-29 发布MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who co...

CVE-2026-115706

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escal

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

CVE-2026-110309

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to i

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrar...

CVE-2026-110196

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypas

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component co...

CVE-2026-110193

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布INFO

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal cor...

CVE-2026-108097

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core a

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS comm...

CVE-2026-107326

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers vers...

CVE-2026-107312

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Al

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from ...

CVE-2026-107311

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsin

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-30 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Countr...

CVE-2026-107308

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country all

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布INFO

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVE-2026-107307

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link...

CVE-2026-107306

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link A

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布INFO

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two F...

CVE-2026-107268

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless

来源摘录 · NVD

#cve #cwe-201