2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布CRITICAL

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the le...

CVE-2026-78403

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Ove

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-121 #cwe-862 #severity:critical

漏洞预警2026-10-30 发布CRITICAL

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted ...

CVE-2026-119263

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-30 发布CRITICAL

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML ...

CVE-2026-119261

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execu

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布CRITICAL

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates

CVE-2026-118697

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-27 发布CRITICAL

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE)...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light B

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-26 发布CRITICAL

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device...

CVE-2026-116508

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function su

来源摘录 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-10-26 发布CRITICAL

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-info...

CVE-2026-116505

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file

来源摘录 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-10-26 发布CRITICAL

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `Terr...

CVE-2026-102649

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhoo

来源摘录 · NVD

#cve #cwe-306 #cwe-863

漏洞预警2026-10-26 发布CRITICAL

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time...

CVE-2026-116233

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the comp

来源摘录 · NVD

#cve #cwe-74 #cwe-93

漏洞预警2026-10-13 发布CRITICAL

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially ga...

CVE-2026-48383

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code exe

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布CRITICAL

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially ga...

CVE-2026-75732

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code exe

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布CRITICAL

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web...

CVE-2026-83662

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values s...

CVE-2026-62849

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengin

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword...

CVE-2026-61620

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other a

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

CVE-2026-116852

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-09-17 发布CRITICAL

Azure Arc Elevation of Privilege Vulnerability

CVE-2026-69399

Azure Arc Elevation of Privilege Vulnerability

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-30 发布CRITICAL

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate ...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its

来源摘录 · NVD

#cve #cwe-306 #cwe-942

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandb...

CVE-2026-62853

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-s

来源摘录 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-10-22 发布CRITICAL

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Succes...

CVE-2026-79876

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-22 发布CRITICAL

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication control...

CVE-2026-79875

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjace

来源摘录 · NVD

#cve #cwe-287