2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs ...

CVE-2026-116174

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and Generat

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布MEDIUM

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can ...

CVE-2026-116170

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injec

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-25 发布MEDIUM

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTP...

CVE-2026-116166

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port kee

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-25 发布INFO

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification co...

CVE-2026-116162

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when i

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-25 发布LOW

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers ...

CVE-2026-116142

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocate

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-25 发布LOW

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hel...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() chec

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-26 发布HIGH

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map...

CVE-2026-116098

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoint

来源摘录 · NVD

#cve #cwe-20 #cwe-502

漏洞预警2026-10-25 发布MEDIUM

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_tu...

CVE-2026-116095

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-25 发布HIGH

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The...

CVE-2026-116062

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-25 发布MEDIUM

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a ...

CVE-2026-116058

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEng

来源摘录 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-25 发布MEDIUM

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of...

CVE-2026-116055

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-24 发布HIGH

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A...

CVE-2026-116014

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bi

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-29 发布MEDIUM

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Con...

CVE-2026-115712

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-le

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-23 发布MEDIUM

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of unco

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-29 发布MEDIUM

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: fr...

CVE-2026-115605

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Acces

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Sec...

CVE-2026-114181

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager al

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects Sur...

CVE-2026-110881

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-19 发布MEDIUM

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_ob...

CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding i

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-19 发布HIGH

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify write...

CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding value

来源摘录 · NVD

#cve #cwe-401

漏洞预警2026-10-19 发布HIGH

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and ...

CVE-2026-110682

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level number

来源摘录 · NVD

#cve #cwe-436