2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布MEDIUM

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuse...

CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布LOW

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-refer...

CVE-2026-119602

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that al

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-p...

CVE-2026-119577

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access thro

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布MEDIUM

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrade...

CVE-2026-119574

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-567

漏洞预警2026-10-30 发布MEDIUM

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation whe...

CVE-2026-119573

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cr

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布LOW

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave trigge...

CVE-2026-119570

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to re

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布MEDIUM

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-prope...

CVE-2026-119569

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-co

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an u...

CVE-2026-119542

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursiv

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Store...

CVE-2026-119370

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].cu...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a ...

CVE-2026-116860

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Contr

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, strea...

CVE-2026-116685

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-26 发布MEDIUM

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Obj...

CVE-2026-116590

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Sna

来源摘录 · NVD

#cve #cwe-129 #cwe-787

漏洞预警2026-10-26 发布MEDIUM

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript...

CVE-2026-116582

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. P

来源摘录 · NVD

#cve #cwe-116 #cwe-79

漏洞预警2026-10-23 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could s...

CVE-2026-115585

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malform

来源摘录 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-30 发布LOW

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ lib...

CVE-2026-115456

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminat

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布INFO

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.

CVE-2026-114462

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServ

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-21 发布HIGH

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for ea...

CVE-2026-113811

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure s

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布MEDIUM

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verific...

CVE-2026-113799

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 exp

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-21 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around larg...

CVE-2026-113795

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large nu

来源摘录 · NVD

#cve #cwe-400 #cwe-770