2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-20 发布HIGH

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...

CVE-2026-91239

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attacker...

CVE-2026-114392

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets ou

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MyS...

CVE-2026-101755

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布HIGH

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4....

CVE-2026-101781

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Su

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布HIGH

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7....

CVE-2026-101771

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-09-02 发布HIGH

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can ...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before

来源摘录 · NVD

#cve #cwe-367

漏洞预警2026-09-02 发布HIGH

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across

来源摘录 · NVD

#cve #cwe-775

漏洞预警2026-10-21 发布HIGH

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase resp...

CVE-2026-61902

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTT

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布HIGH

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SY...

CVE-2026-59229

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布HIGH

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was ava...

CVE-2026-58064

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with ...

CVE-2026-56387

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote u

来源摘录 · NVD

#cve #cwe-770 #cwe-789

漏洞预警2026-10-21 发布HIGH

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser rec...

CVE-2026-54427

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by se

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-21 发布HIGH

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP...

CVE-2026-54426

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bR

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-21 发布HIGH

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block conta...

CVE-2026-54425

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-49116

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-49115

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD

#cve

漏洞预警2026-08-14 发布INFO

Rejected reason: Rejected as this CVE is duplicate to CVE-2026-4890.

CVE-2026-13002

Rejected reason: Rejected as this CVE is duplicate to CVE-2026-4890.

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布HIGH

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory'...

CVE-2026-119578

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows a

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only...

CVE-2026-119576

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readReco

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP b...

CVE-2026-119575

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users

来源摘录 · NVD

#cve #cwe-918