2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-20 发布HIGH

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redi...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly u

来源摘录 · NVD

#cve #cwe-297

漏洞预警2026-10-20 发布HIGH

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends a...

CVE-2026-86409

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentatio

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-23 发布LOW

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for ...

CVE-2026-83813

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.name

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-21 发布INFO

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and cal...

CVE-2026-70387

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2

来源摘录 · NVD

#cve #cwe-749 #cwe-863

漏洞预警2026-07-22 发布MEDIUM

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedRes...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-07-22 发布HIGH

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can ...

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic

来源摘录 · NVD

#cve #cwe-917

漏洞预警2026-07-22 发布MEDIUM

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution re...

CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-07-22 发布HIGH

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewe...

CVE-2026-65015

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布INFO

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_ser...

CVE-2026-61546

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard appli

来源摘录 · NVD

#cve #cwe-346 #cwe-350

漏洞预警2026-10-28 发布INFO

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can cras...

CVE-2026-59959

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

来源摘录 · NVD

#cve #cwe-369

漏洞预警2026-07-15 发布MEDIUM

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check...

CVE-2026-59259

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-07-08 发布HIGH

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation subst...

CVE-2026-59257

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy My

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-07-15 发布INFO

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authen...

CVE-2026-59254

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in wo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-28 发布HIGH

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authoriz...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布HIGH

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a conf...

CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` un

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-07-10 发布MEDIUM

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does...

CVE-2026-58661

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-tab

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-27 发布HIGH

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files r...

CVE-2026-58205

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` para

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is bu...

CVE-2026-58202

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

来源摘录 · NVD

#cve #cwe-640

漏洞预警2026-07-08 发布MEDIUM

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope ins...

CVE-2026-56778

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint,

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-06-30 发布MEDIUM

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to cre...

CVE-2026-56777

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Pytho

来源摘录 · NVD

#cve #cwe-184