2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismat...

CVE-2026-119601

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrup

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths...

CVE-2026-119600

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process

来源摘录 · NVD

#cve #cwe-130

漏洞预警2026-10-30 发布MEDIUM

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to ...

CVE-2026-119566

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google I

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in Desi...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE pri

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /data...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supply

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures a...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionRespo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布LOW

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free...

CVE-2026-119558

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-pr

来源摘录 · NVD

#cve #cwe-841

漏洞预警2026-10-30 发布MEDIUM

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_fee...

CVE-2026-119555

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an inform

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin...

CVE-2026-119554

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injectio

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library ...

CVE-2026-119551

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布LOW

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting p...

CVE-2026-119550

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows au

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG ...

CVE-2026-119549

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecur

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /co...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remov

来源摘录 · NVD

#cve #cwe-620

漏洞预警2026-10-30 发布LOW

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to t

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Atta...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POS...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arb

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布MEDIUM

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to ...

CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/repo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authent...

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that sk

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers...

CVE-2026-119146

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap

来源摘录 · NVD

#cve #cwe-120

漏洞预警2026-10-30 发布INFO

Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.

CVE-2026-117349

Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.

来源摘录 · NVD

#cve