2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

← 返回归档列表

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL wit...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently reje...

CVE-2026-118767

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containi

来源摘录 · NVD

#cve #cwe-158

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Autho...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while po

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-13 发布HIGH

Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

CVE-2026-83647

Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-28 发布HIGH

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder pa...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticate

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. ...

CVE-2026-118694

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by sub

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-28 发布INFO

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handler...

CVE-2026-118668

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or Typ

来源摘录 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-10-28 发布HIGH

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href U...

CVE-2026-118660

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy D

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path s...

CVE-2026-118656

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-29 发布MEDIUM

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation...

CVE-2026-118589

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-13 发布MEDIUM

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

CVE-2026-83933

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authoriz

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Render...

CVE-2026-118538

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTr

来源摘录 · NVD

#cve #cwe-913 #cwe-915

漏洞预警2026-10-29 发布MEDIUM

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security...

CVE-2026-118092

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

CVE-2026-118080

Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布HIGH

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

CVE-2026-118075

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which inco...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue oc

来源摘录 · NVD

#cve #cwe-670

漏洞预警2026-10-29 发布HIGH

Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.

CVE-2026-116867

Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-23 发布LOW

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using tra...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows att

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-23 发布MEDIUM

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attac...

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to byp

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds wh...

CVE-2026-115580

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cr

来源摘录 · NVD

#cve #cwe-834