2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-25 发布MEDIUM

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiv...

CVE-2026-116185

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read oth

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or ...

CVE-2026-114471

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-07-22 发布HIGH

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Toke...

CVE-2026-65595

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardle

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-25 发布LOW

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concr...

CVE-2026-116197

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller

来源摘录 · NVD

#cve #cwe-1289

漏洞预警2026-07-22 发布HIGH

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-ass...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-28 发布HIGH

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELE...

CVE-2026-59179

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-27 发布INFO

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `as...

CVE-2026-57203

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2

来源摘录 · NVD

#cve #cwe-426

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(...

CVE-2026-118778

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-20 发布MEDIUM

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.

CVE-2026-111088

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-by...

CVE-2026-55606

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHC

来源摘录 · NVD

#cve #cwe-126

漏洞预警2026-09-08 发布LOW

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versio...

CVE-2026-84392

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all v

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-09-08 发布HIGH

An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 th...

CVE-2026-84387

An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerabil

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-08-12 发布MEDIUM

A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all...

CVE-2026-71408

A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-07-14 发布MEDIUM

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0...

CVE-2026-59837

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-04-14 发布MEDIUM

Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.13, Fo...

CVE-2026-39814

Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiW

来源摘录 · NVD

#cve #cwe-23

漏洞预警2026-10-25 发布INFO

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only throug...

CVE-2026-116186

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布LOW

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiP...

CVE-2026-106175

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, F

来源摘录 · NVD

#cve #cwe-415

漏洞预警2026-10-29 发布INFO

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to ar...

CVE-2026-107039

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is...

CVE-2026-79589

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布HIGH

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/templat...

CVE-2026-59979

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snaps

来源摘录 · NVD

#cve #cwe-639 #cwe-862