2026-10-30 归档

今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.

CVE-2026-110245

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper auth

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.

CVE-2026-110200

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-312

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

CVE-2026-110192

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system...

CVE-2026-104331

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system...

CVE-2026-104315

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布LOW

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended e...

CVE-2026-104312

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive co

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

CVE-2026-104310

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS c...

CVE-2026-104308

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to im

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

CVE-2026-102590

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary comm...

CVE-2026-78674

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can oc...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for i

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-28 发布LOW

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. Thi...

CVE-2026-3583

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invali

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-28 发布MEDIUM

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacke...

CVE-2026-11854

The authentication endpoint generates an error message that includes reflected data directly from the request without su

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布HIGH

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation const...

CVE-2025-14260

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to reso

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布INFO

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘e...

CVE-2026-7190

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnera

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page ...

CVE-2026-5702

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticat

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5700

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5699

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5698

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布INFO

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed...

CVE-2026-5697

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code

来源摘录 · NVD

#cve #cwe-79