2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejectin...

CVE-2026-118248

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode wal

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser canno...

CVE-2026-118244

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2023-09-12 发布MEDIUM

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only e...

CVE-2023-4813

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-416

漏洞预警2012-12-26 发布MEDIUM

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating ...

CVE-2012-5625

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not prope

来源摘录 · NVD

#cve #cwe-200 #cwe-212

漏洞预警2012-12-18 发布MEDIUM

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keyston...

CVE-2012-5571

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authoriz

来源摘录 · NVD

#cve #cwe-255 #cwe-639

漏洞预警2011-12-10 发布MEDIUM

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the...

CVE-2011-4346

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authentic

来源摘录 · NVD

#cve #cwe-79

漏洞预警2014-02-05 发布MEDIUM

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HT...

CVE-2011-3344

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Lo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2014-02-05 发布MEDIUM

A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or ...

CVE-2011-2927

A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), al

来源摘录 · NVD

#cve #cwe-79

漏洞预警2014-02-05 发布MEDIUM

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into w...

CVE-2011-2920

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2014-02-05 发布MEDIUM

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipul...

CVE-2011-1594

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote atta

来源摘录 · NVD

#cve #cwe-20 #cwe-601

漏洞预警2011-07-27 发布MEDIUM

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. ...

CVE-2009-4139

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote a

来源摘录 · NVD

#cve #cwe-346 #cwe-352

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrar...

CVE-2026-110196

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypas

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-107329

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

CVE-2026-107327

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missi

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS comm...

CVE-2026-107326

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

CVE-2026-104324

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deser

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

CVE-2026-101288

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-08-18 发布MEDIUM

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tablet...

CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended beha...

CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on in

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_s...

CVE-2026-63914

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns

来源摘录 · NVD

#cve #cwe-668 #cwe-862