2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-21 发布MEDIUM

Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to ou...

CVE-2026-114473

Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布LOW

Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to cause a certi...

CVE-2026-114472

Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6

来源摘录 · NVD

#cve #cwe-410

漏洞预警2026-10-21 发布MEDIUM

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-...

CVE-2026-114470

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-26 发布MEDIUM

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 1...

CVE-2026-113896

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-07-30 发布MEDIUM

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a perm...

CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-direc

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-26 发布HIGH

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic

CVE-2026-107091

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code vi

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a not...

CVE-2026-107037

Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attac

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-29 发布HIGH

Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content.

CVE-2026-107026

Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwri

来源摘录 · NVD

#cve #cwe-732

漏洞预警2026-10-29 发布HIGH

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.

CVE-2026-107020

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-04 发布HIGH

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment ...

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布HIGH

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act ...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布HIGH

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own tok...

CVE-2026-105208

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption,

来源摘录 · NVD

#cve #cwe-649

漏洞预警2026-10-04 发布INFO

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization r...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, whi

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布LOW

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured poli...

CVE-2026-105081

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthori

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-26 发布HIGH

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain se...

CVE-2026-104596

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-26 发布HIGH

libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.

CVE-2026-104591

libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-02 发布LOW

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator v...

CVE-2026-104436

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust b

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-13 发布HIGH

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with...

CVE-2026-104085

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors t

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-21 发布HIGH

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extensio...

CVE-2026-102486

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash t

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布MEDIUM

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose me...

CVE-2026-102485

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls th

来源摘录 · NVD

#cve #cwe-125