2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-09-07 发布MEDIUM

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can...

CVE-2026-86423

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList metho

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-09-07 发布LOW

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions b...

CVE-2026-86422

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows tha

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-09-07 发布HIGH

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing a...

CVE-2026-86421

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-09-07 发布HIGH

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhau...

CVE-2026-86420

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCa

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-09-03 发布MEDIUM

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access wo...

CVE-2026-85173

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布MEDIUM

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic che...

CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exp

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布MEDIUM

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials t...

CVE-2026-85171

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailch

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-09-03 发布MEDIUM

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated u...

CVE-2026-85170

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-09-03 发布HIGH

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiri...

CVE-2026-85169

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI re

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-09-03 发布HIGH

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys...

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布MEDIUM

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, wh...

CVE-2026-85167

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-09-03 发布MEDIUM

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow T...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布MEDIUM

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project per...

CVE-2026-84807

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team c

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-08-18 发布HIGH

CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0....

CVE-2026-75857

CodeWhale versions >= 0.3.10 and = 0.3.10 and = 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-08-13 发布HIGH

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability ...

CVE-2026-73608

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-08-14 发布INFO

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: ch...

CVE-2026-73051

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts re

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-08-14 发布HIGH

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks on...

CVE-2026-72831

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in it

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-08-14 发布HIGH

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-targe...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subs

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-08-14 发布HIGH

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enfo...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-08-14 发布INFO

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to File...

CVE-2026-72814

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-exi

来源摘录 · NVD

#cve #cwe-22