2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-31 发布INFO

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to...

CVE-2026-118629

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contrib...

CVE-2026-118438

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently de...

CVE-2026-118437

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachme

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacke...

CVE-2026-118185

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to...

CVE-2026-118184

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the store

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to m...

CVE-2026-118043

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a fil

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布MEDIUM

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all ...

CVE-2026-116563

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-31 发布HIGH

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as th...

CVE-2026-116520

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布INFO

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, al...

CVE-2026-110808

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assig

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布HIGH

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formDat...

CVE-2026-109997

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布HIGH

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5...

CVE-2026-109234

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-94 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-94 #severity:medium

漏洞预警2026-10-31 发布HIGH

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:high

漏洞预警2026-10-31 发布HIGH

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access...

CVE-2026-116755

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-78 #severity:high

漏洞预警2026-10-31 发布MEDIUM

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (h...

CVE-2026-77152

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collecti

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-285 #severity:medium

漏洞预警2026-10-30 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111477

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布HIGH

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billi...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-693 #severity:high

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted qualname (for example "Values.read_file") is resolved by pickle's find_class throug...

CVE-2026-118938

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-706 #severity:high