2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-22 发布CRITICAL

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify ...

CVE-2026-79858

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布CRITICAL

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host i...

CVE-2026-79846

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote at

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-10-30 发布CRITICAL

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `PO...

CVE-2026-55598

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布CRITICAL

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape ...

CVE-2026-116241

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the que

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-115 #cwe-78 #severity:critical

漏洞预警2026-10-29 发布CRITICAL

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

CVE-2026-107058

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another us

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-30 发布CRITICAL

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker...

CVE-2025-31704

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially craf

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布CRITICAL

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'm...

CVE-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admi

来源摘录 · NVD

#cve #cwe-1394

漏洞预警2026-10-30 发布CRITICAL

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:S...

CVE-2026-119597

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVE-2026-90888

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

CVE-2026-39738

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

CVE-2026-39732

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

CVE-2026-119526

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Roy

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

CVE-2026-116386

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-22 发布CRITICAL

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Success...

CVE-2026-79868

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacke

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布CRITICAL

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run ...

CVE-2026-79867

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacke

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布CRITICAL

An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attac...

CVE-2026-79866

An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vu

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布CRITICAL

A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation ...

CVE-2026-79865

A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker t

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-22 发布CRITICAL

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploi...

CVE-2026-79864

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-10-22 发布CRITICAL

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially craf...

CVE-2026-79863

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent att

来源摘录 · NVD

#cve #cwe-120

漏洞预警2026-10-22 发布CRITICAL

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially craf...

CVE-2026-79862

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent att

来源摘录 · NVD

#cve #cwe-120