2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute nam...

CVE-2026-117645

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework p

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack o...

CVE-2026-119730

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-451 #severity:medium

漏洞预警2026-10-30 发布HIGH

Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the ...

CVE-2026-78402

Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overf

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-121 #cwe-787 #severity:high

漏洞预警2026-10-30 发布MEDIUM

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting i...

CVE-2026-116251

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own chang

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-613 #severity:low

漏洞预警2026-10-30 发布MEDIUM

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints ...

CVE-2026-116248

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Sha

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-862 #severity:medium

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_fil...

CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relat

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #cwe-73 #severity:high

漏洞预警2026-10-30 发布HIGH

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// U...

CVE-2026-116252

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-522 #cwe-88 #cwe-918 #severity:high

漏洞预警2026-10-30 发布HIGH

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the con...

CVE-2026-116247

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one coul

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it ...

CVE-2026-116250

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permissio

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-367 #cwe-59 #severity:high

漏洞预警2026-10-30 发布HIGH

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.

CVE-2026-115829

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successful

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-288 #severity:high

漏洞预警2026-10-30 发布MEDIUM

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileg...

CVE-2026-119086

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enable

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-121 #cwe-843

漏洞预警2026-10-29 发布INFO

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, si...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and e

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-176 #cwe-754

漏洞预警2026-10-29 发布INFO

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one ...

CVE-2026-51902

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/

来源摘录 · NVD / OSV.dev

#advisory #cve

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentiall...

CVE-2026-91917

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileg

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability...

CVE-2026-91915

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output U

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low ...

CVE-2026-91913

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布HIGH

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. E...

CVE-2026-87356

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). S

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布HIGH

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the pr...

CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布HIGH

Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit...

CVE-2026-76031

Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code insi

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布HIGH

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML pag...

CVE-2026-76030

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute

来源摘录 · NVD

#cve #cwe-119