Cyber Security Daily Radar

2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表
漏洞预警2026-10-29 发布HIGH

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression s...

CVE-2026-119202

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored p

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory#cve#cwe-1333#npm#severity:high
漏洞预警2026-10-29 发布MEDIUM

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, ...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1,

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory#cve#cwe-405#npm#severity:medium
漏洞预警2026-10-29 发布MEDIUM

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(...

CVE-2026-118773

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including Gl

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory#cve#cwe-400#npm#severity:medium
漏洞预警2026-10-27 发布HIGH

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfig...

CVE-2026-116672

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientC

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1188#cwe-639#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label n...

CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-400#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested pars...

CVE-2026-119207

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-400#cwe-405#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted en...

CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory wh

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-400#cwe-770#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that ...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while openi

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory#cve#cwe-400#cwe-770#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragme...

CVE-2026-119196

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copi

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-407#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the rema...

CVE-2026-119197

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-407#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes va...

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repe

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-407#pip#severity:high
漏洞预警2026-10-29 发布HIGH

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one...

CVE-2026-119194

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-407#pip#severity:high
漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first...

CVE-2026-118775

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-190#npm#severity:low
漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set...

CVE-2026-118777

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1321#npm#severity:medium
漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, m...

CVE-2026-118779

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1333#cwe-400#npm#severity:high
漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInv...

CVE-2026-118781

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-835#npm#severity:low
漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(...

CVE-2026-118780

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-295#cwe-471#npm#severity:low
漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option pas...

CVE-2026-119186

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1284#cwe-354#npm#severity:medium
漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based ...

CVE-2026-118782

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-1284#cwe-354#npm#severity:high
漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(...

CVE-2026-119188

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-248#cwe-476#npm#severity:high