2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布LOW

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions...

CVE-2026-114555

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-29 发布HIGH

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM sessi...

CVE-2026-45049

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`C

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-201

漏洞预警2026-10-29 发布INFO

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the p...

CVE-2026-119282

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-78 #cwe-88

漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING ...

CVE-2026-119191

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-400 #cwe-674

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check....

CVE-2026-118769

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size con

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-125 #cwe-681 #cwe-787

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL wit...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-347

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently reje...

CVE-2026-118767

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containi

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-158

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Autho...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while po

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-918

漏洞预警2026-10-29 发布HIGH

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

CVE-2026-11587

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-89

漏洞预警2026-10-29 发布MEDIUM

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can...

CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause w

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-122

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete resp...

CVE-2026-118260

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-400 #cwe-770

漏洞预警2026-10-27 发布INFO

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on a...

CVE-2026-116693

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QU

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1333

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search param...

CVE-2026-116892

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unesca...

CVE-2026-116888

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with th

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allo...

CVE-2026-116884

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-23 发布HIGH

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFile...

CVE-2026-114622

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcTheme

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-180 #cwe-22

漏洞预警2026-10-23 发布MEDIUM

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a pub...

CVE-2026-115479

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated v

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-20

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-control...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthent

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-918

漏洞预警2026-09-08 发布HIGH

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-81396

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

来源摘录 · NVD

#cve #cwe-121 #cwe-193