2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-21 发布MEDIUM

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd v...

CVE-2026-102484

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Te

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-21 发布HIGH

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

CVE-2026-102483

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request wi

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-14 发布MEDIUM

An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to ...

CVE-2026-101987

An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Juno

来源摘录 · NVD

#cve #cwe-1284

漏洞预警2026-09-27 发布MEDIUM

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.D...

CVE-2026-100834

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.

来源摘录 · NVD

#cve #cwe-294

漏洞预警2026-09-27 发布MEDIUM

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that d...

CVE-2026-100725

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (clien

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-09-27 发布MEDIUM

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and rever...

CVE-2026-100724

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-09-26 发布HIGH

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during ...

CVE-2026-100709

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-07-18 发布HIGH

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. A...

CVE-2025-71398

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-n

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-07-18 发布MEDIUM

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to def...

CVE-2025-71397

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permi

来源摘录 · NVD

#cve #cwe-835

漏洞预警2026-07-18 发布MEDIUM

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting ...

CVE-2025-71396

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on em

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-07-18 发布MEDIUM

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex pattern...

CVE-2025-71395

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-07-18 发布MEDIUM

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file syst...

CVE-2025-71394

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows aut

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-07-18 发布MEDIUM

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated...

CVE-2025-71393

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain e

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-07-18 发布HIGH

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System Use...

CVE-2025-71392

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-07-18 发布MEDIUM

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted H...

CVE-2025-71391

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-06-30 发布MEDIUM

Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. ...

CVE-2025-71381

Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the

来源摘录 · NVD

#cve #cwe-113

漏洞预警2025-06-17 发布HIGH

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 r...

CVE-2025-34509

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 1

来源摘录 · NVD

#cve #cwe-798

漏洞预警2025-12-11 发布HIGH

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a spec...

CVE-2025-34506

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrator

来源摘录 · NVD

#cve #cwe-434

漏洞预警2025-12-22 发布INFO

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_...

CVE-2025-34458

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion v

来源摘录 · NVD

#cve #cwe-617

漏洞预警2025-12-22 发布INFO

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() loca...

CVE-2025-34457

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer ov

来源摘录 · NVD

#cve #cwe-121