2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-21 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to ...

CVE-2026-113791

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a conte

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-30 发布LOW

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malic...

CVE-2026-112922

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a spec

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布HIGH

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remo...

CVE-2026-112408

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SD

来源摘录 · NVD

#cve #cwe-940

漏洞预警2026-06-04 发布HIGH

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions ...

CVE-2026-10843

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are pro

来源摘录 · NVD

#cve #cwe-250

漏洞预警2026-06-15 发布MEDIUM

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code perf...

CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options.

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-21 发布MEDIUM

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be proc...

CVE-2024-6423

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data t

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-21 发布HIGH

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the...

CVE-2026-76291

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_sear

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily expl...

CVE-2026-101432

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Suppor

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-20 发布LOW

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult ...

CVE-2026-101415

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Suppo

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布HIGH

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system c...

CVE-2026-76293

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布MEDIUM

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security ...

CVE-2026-119272

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-30 发布MEDIUM

Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromi...

CVE-2026-76024

Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read m

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-21 发布MEDIUM

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcet...

CVE-2026-76296

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power"

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-76027

Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-21 发布MEDIUM

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capabilit...

CVE-2026-76297

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-21 发布HIGH

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser passwo...

CVE-2026-76298

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles coul

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult ...

CVE-2026-101412

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Suppo

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7...

CVE-2026-101780

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versi

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布LOW

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9....

CVE-2026-101779

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry). Supported vers

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-21 发布HIGH

External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin ...

CVE-2026-86147

External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all pla

来源摘录 · NVD

#cve #cwe-400 #cwe-73