2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the ge...

CVE-2026-118765

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then

来源摘录 · NVD

#cve #cwe-335

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives witho...

CVE-2026-118761

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=vo...

CVE-2026-118758

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity J...

CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does n

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-28 发布HIGH

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfi...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows w...

CVE-2026-118678

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExt...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP hea

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-28 发布HIGH

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto...

CVE-2026-118649

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner projec

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base...

CVE-2026-118645

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoi...

CVE-2026-118641

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in th

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead ...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-sup

来源摘录 · NVD

#cve #cwe-348

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small com...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded reque

来源摘录 · NVD

#cve #cwe-400 #cwe-409

漏洞预警2026-10-28 发布HIGH

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and even...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-

来源摘录 · NVD

#cve #cwe-116 #cwe-79

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than insert...

CVE-2026-118253

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode par

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. O...

CVE-2026-118249

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data col

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highchart...

CVE-2026-118245

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartCon

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-25 发布HIGH

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unesc...

CVE-2026-116211

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche fiel

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-25 发布MEDIUM

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax...

CVE-2026-116205

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布HIGH

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs ha...

CVE-2026-116201

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions

来源摘录 · NVD

#cve #cwe-294

漏洞预警2026-10-26 发布MEDIUM

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the co...

CVE-2026-116124

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_

来源摘录 · NVD

#cve #cwe-119 #cwe-122