2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe ...

CVE-2026-56836

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console en

来源摘录 · NVD

#cve #cwe-287 #cwe-306 #cwe-862

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw f...

CVE-2026-55600

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布INFO

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection informa...

CVE-2026-54711

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to versi

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-05-18 发布HIGH

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsibl...

CVE-2026-42009

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) pac

来源摘录 · NVD

#cve #cwe-475

漏洞预警2026-06-08 发布HIGH

STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service a...

CVE-2026-39910

STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated,

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-08-11 发布HIGH

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class fi...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu managem...

CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate p

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints b...

CVE-2026-119557

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticate

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the ...

CVE-2026-119545

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnera

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js p...

CVE-2026-119300

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJ...

CVE-2026-119290

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered repor

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-29 发布INFO

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization c...

CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-29 发布HIGH

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a ...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-30 发布MEDIUM

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, ...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inj

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布LOW

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries whil...

CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-30 发布HIGH

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated ...

CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布HIGH

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and incl...

CVE-2026-116622

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size ch...

CVE-2026-110133

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an account

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-19 发布MEDIUM

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue af...

CVE-2026-108780

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin back

来源摘录 · NVD

#cve #cwe-20