2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-29 发布HIGH

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or bool...

CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers ...

CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions wit...

CVE-2026-118905

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.

来源摘录 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-10-28 发布MEDIUM

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished dra...

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布INFO

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant hand...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布HIGH

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaini...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM

来源摘录 · NVD

#cve #cwe-35

漏洞预警2026-10-29 发布INFO

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceCont...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing tel

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布HIGH

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching thr...

CVE-2026-116795

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.

来源摘录 · NVD

#cve #cwe-1333 #cwe-407

漏洞预警2026-10-28 发布HIGH

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who posse...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1,

来源摘录 · NVD

#cve #cwe-78 #cwe-862

漏洞预警2026-10-28 发布HIGH

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer ...

CVE-2026-112357

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local pri

来源摘录 · NVD

#cve #cwe-276

漏洞预警2026-10-28 发布MEDIUM

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-29 发布HIGH

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets...

CVE-2019-25781

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows r

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after o...

CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/func

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Str...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passe

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-29 发布HIGH

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates...

CVE-2026-119144

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-lengt...

CVE-2026-119143

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start fu...

CVE-2026-119140

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious

来源摘录 · NVD

#cve #cwe-372

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker ...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejec

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebA...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and

来源摘录 · NVD

#cve #cwe-1265