2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-19 发布MEDIUM

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode...

CVE-2026-108776

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-19 发布MEDIUM

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house ...

CVE-2026-108766

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-19 发布MEDIUM

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house...

CVE-2026-108764

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-19 发布HIGH

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-h...

CVE-2026-108762

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are dire

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-20 发布HIGH

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of th...

CVE-2026-107929

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-20 发布HIGH

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_s...

CVE-2026-107928

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due

来源摘录 · NVD

#cve #cwe-126

漏洞预警2026-10-30 发布HIGH

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and ...

CVE-2026-104368

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up

来源摘录 · NVD

#cve #cwe-116

漏洞预警2026-10-20 发布HIGH

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size s...

CVE-2026-103672

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then cop

来源摘录 · NVD

#cve #cwe-129

漏洞预警2024-10-09 发布MEDIUM

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction ...

CVE-2024-9675

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are

来源摘录 · NVD

#cve #cwe-22

漏洞预警2024-08-12 发布HIGH

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the U...

CVE-2024-7557

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models w

来源摘录 · NVD

#cve #cwe-305

漏洞预警2026-10-21 发布MEDIUM

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypa...

CVE-2024-5563

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha op

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布MEDIUM

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be trigg...

CVE-2024-5139

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malic

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布MEDIUM

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could...

CVE-2024-4989

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by ma

来源摘录 · NVD

#cve #cwe-601

漏洞预警2025-01-22 发布HIGH

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfi...

CVE-2024-11218

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 a

来源摘录 · NVD

#cve #cwe-269

漏洞预警2013-07-31 发布HIGH

A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of...

CVE-2013-2056

A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between

来源摘录 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2019-12-02 发布HIGH

A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to informati...

CVE-2012-5562

A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text whe

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-30 发布HIGH

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in...

CVE-2026-61739

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77,

来源摘录 · NVD

#cve #cwe-287 #cwe-862

漏洞预警2026-10-30 发布HIGH

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data...

CVE-2026-61708

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76,

来源摘录 · NVD

#cve #cwe-284 #cwe-639 #cwe-862

漏洞预警2026-10-30 发布HIGH

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unseriali...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `publ

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously

来源摘录 · NVD

#cve #cwe-79