2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control ch...

CVE-2026-118994

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the logi

来源摘录 · NVD

#cve #cwe-117

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch h...

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expre

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and c...

CVE-2026-118991

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getC

来源摘录 · NVD

#cve #cwe-916

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite...

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when takin

来源摘录 · NVD

#cve #cwe-379 #cwe-59

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its ...

CVE-2026-118988

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only whe...

CVE-2026-118987

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cook

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two cal...

CVE-2026-118986

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). Th

来源摘录 · NVD

#cve #cwe-338

漏洞预警2026-10-30 发布INFO

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.

CVE-2026-112605

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to re

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.

CVE-2026-112602

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be ab

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datata...

CVE-2026-65874

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) a

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects ...

CVE-2026-64618

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fine

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-29 发布MEDIUM

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authenticati...

CVE-2026-119278

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD

#cve #cwe-129 #cwe-789

漏洞预警2026-10-29 发布HIGH

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user ...

CVE-2026-119115

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer)

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ...

CVE-2026-118776

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD

#cve #cwe-20 #cwe-354

漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), ...

CVE-2026-118774

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could ...

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An una

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially...

CVE-2026-91912

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A lo

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privil...

CVE-2026-111503

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potential...

CVE-2026-111502

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A l

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjace...

CVE-2026-111501

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attemp

来源摘录 · NVD

#cve #cwe-307