2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-29 发布HIGH

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controll...

CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle

来源摘录 · NVD

#cve #cwe-352 #cwe-639

漏洞预警2026-10-29 发布INFO

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` ...

CVE-2026-61654

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-29 发布HIGH

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM sessi...

CVE-2026-45049

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`C

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-29 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document excee...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a

来源摘录 · NVD

#cve #cwe-400 #cwe-401

漏洞预警2026-10-29 发布MEDIUM

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the ...

CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain

来源摘录 · NVD

#cve #cwe-346 #cwe-942

漏洞预警2026-10-29 发布INFO

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization c...

CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布HIGH

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a ...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布INFO

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the p...

CVE-2026-119282

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and

来源摘录 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-10-07 发布MEDIUM

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret res...

CVE-2026-107176

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config

来源摘录 · NVD

#cve #cwe-250

漏洞预警2024-10-01 发布MEDIUM

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned...

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized b

来源摘录 · NVD

#cve #cwe-457

漏洞预警2026-09-18 发布HIGH

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divid...

CVE-2026-93589

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for t

来源摘录 · NVD

#cve #cwe-369

漏洞预警2026-09-18 发布MEDIUM

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point durin...

CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder re

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-09-18 发布LOW

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option i...

CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CU

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布LOW

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitat...

CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, cau

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-09-16 发布MEDIUM

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths...

CVE-2026-92588

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-09-16 发布MEDIUM

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but th...

CVE-2026-92587

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relativ

来源摘录 · NVD

#cve #cwe-426

漏洞预警2026-09-14 发布HIGH

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupServic...

CVE-2026-90932

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. C

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-09-14 发布MEDIUM

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload ma...

CVE-2026-90931

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-09-07 发布MEDIUM

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of...

CVE-2026-86425

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-09-07 发布LOW

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write rest...

CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decod

来源摘录 · NVD

#cve #cwe-59