2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/...

CVE-2026-45141

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `sav

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布MEDIUM

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_Quick...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1,

来源摘录 · NVD

#cve #cwe-95

漏洞预警2026-10-30 发布MEDIUM

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, wri...

CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect s

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a d...

CVE-2026-119289

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...)

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applyi...

CVE-2026-119287

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another ...

CVE-2026-119038

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the...

CVE-2026-119037

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or e

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-leve...

CVE-2026-119036

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer o...

CVE-2026-116128

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked re

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not...

CVE-2026-116127

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persi

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding c

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysre...

CVE-2026-115865

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting me

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, wh...

CVE-2025-68395

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInp...

CVE-2025-68394

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisate...

CVE-2025-68393

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific e...

CVE-2025-68392

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved f

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary fol...

CVE-2025-68391

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbi

来源摘录 · NVD

#cve #cwe-434

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single f...

CVE-2026-13576

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed wit

来源摘录 · NVD

#cve #cwe-759 #cwe-916

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser...

CVE-2026-118996

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserC

来源摘录 · NVD

#cve #cwe-212

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied patte...

CVE-2026-118995

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. creat

来源摘录 · NVD

#cve #cwe-625