2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network acc...

CVE-2026-111500

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerabili

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access...

CVE-2026-111499

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource v

来源摘录 · NVD

#cve #cwe-732

漏洞预警2026-10-30 发布MEDIUM

OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this ...

CVE-2026-111498

OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged a

来源摘录 · NVD

#cve #cwe-413

漏洞预警2026-10-30 发布LOW

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially...

CVE-2026-101209

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布HIGH

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitiza...

CVE-2026-97645

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布HIGH

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affect...

CVE-2026-92210

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attac

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布HIGH

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB...

CVE-2026-92207

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-21 发布HIGH

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins...

CVE-2026-92206

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows r

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-21 发布MEDIUM

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installati...

CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote a

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布HIGH

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbi...

CVE-2026-92204

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. Th

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布HIGH

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate ar...

CVE-2026-92203

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布HIGH

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the cu...

CVE-2026-82987

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote,

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This ...

CVE-2026-65444

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Bl

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布HIGH

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as truste...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's

来源摘录 · NVD

#cve #cwe-501

漏洞预警2026-10-29 发布INFO

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` ...

CVE-2026-61576

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write...

CVE-2026-57117

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgen

来源摘录 · NVD

#cve #cwe-78 #cwe-863

漏洞预警2026-10-23 发布HIGH

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty str...

CVE-2026-55457

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version

来源摘录 · NVD

#cve #cwe-1392 #cwe-287

漏洞预警2026-10-22 发布LOW

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp cl...

CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布MEDIUM

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants...

CVE-2026-119708

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other pro...

CVE-2026-119665

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionVi

来源摘录 · NVD

#cve #cwe-862