2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-22 发布LOW

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locke...

CVE-2026-103515

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. ...

CVE-2026-100420

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers

来源摘录 · NVD

#cve #cwe-202

漏洞预警2026-06-10 发布MEDIUM

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multip...

CVE-2025-8444

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerabl

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布MEDIUM

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

CVE-2025-13050

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布HIGH

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, ...

CVE-2025-0326

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account ma

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-21 发布MEDIUM

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. Th...

CVE-2024-7478

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or

来源摘录 · NVD

#cve #cwe-204

漏洞预警2026-09-23 发布MEDIUM

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is ca...

CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ ->

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-09-23 发布MEDIUM

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_dat...

CVE-2026-67228

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coer

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-09-23 发布MEDIUM

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_m...

CVE-2026-66069

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_author

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布MEDIUM

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls b...

CVE-2026-67238

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-30 发布MEDIUM

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could al...

CVE-2026-118165

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit a...

CVE-2026-118101

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to...

CVE-2026-118100

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before expor

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布MEDIUM

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer det...

CVE-2026-118072

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to mana

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users w...

CVE-2026-118071

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an H

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege us...

CVE-2026-117572

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter befor

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and o...

CVE-2026-117571

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data der

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX...

CVE-2026-115277

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecti

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布HIGH

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored m

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布INFO

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthentica...

CVE-2026-82104

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 thr

来源摘录 · NVD

#cve #cwe-306