2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-29 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resourc...

CVE-2026-119204

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsi

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference ...

CVE-2026-119203

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening

来源摘录 · NVD

#cve #cwe-835

漏洞预警2026-10-29 发布HIGH

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression s...

CVE-2026-119202

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored p

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret,...

CVE-2026-119201

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecr

来源摘录 · NVD

#cve #cwe-552

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro ro...

CVE-2026-119200

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-en

来源摘录 · NVD

#cve #cwe-41 #cwe-436 #cwe-863

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/inde...

CVE-2026-119199

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can exp

来源摘录 · NVD

#cve #cwe-200 #cwe-538

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-er...

CVE-2026-119198

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an expo

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-10-29 发布HIGH

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes va...

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repe

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2....

CVE-2026-119190

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod

来源摘录 · NVD

#cve #cwe-295 #cwe-436

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option pas...

CVE-2026-119186

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod

来源摘录 · NVD

#cve #cwe-1284 #cwe-354

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host....

CVE-2026-119142

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Fut

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons ...

CVE-2026-119138

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending ca

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle alloca...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-29 发布LOW

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but r...

CVE-2026-119126

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values w

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-29 发布MEDIUM

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_...

CVE-2026-119122

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API cl

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-...

CVE-2026-119118

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to interce

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-28 发布HIGH

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_r...

CVE-2026-118803

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, m...

CVE-2026-118779

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD

#cve #cwe-1333 #cwe-400

漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first...

CVE-2026-118775

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check....

CVE-2026-118769

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size con

来源摘录 · NVD

#cve #cwe-125 #cwe-681 #cwe-787