2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted ver...

CVE-2026-63346

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter nam

来源摘录 · NVD

#cve #cwe-116 #cwe-94

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such...

CVE-2026-63345

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object k

来源摘录 · NVD

#cve #cwe-1116 #cwe-94

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verb...

CVE-2026-63344

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the

来源摘录 · NVD

#cve #cwe-116 #cwe-94

漏洞预警2026-10-30 发布HIGH

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqe...

CVE-2026-63341

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or

来源摘录 · NVD

#cve #cwe-248 #cwe-400

漏洞预警2026-10-30 发布INFO

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP...

CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handl

来源摘录 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-30 发布INFO

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specifi...

CVE-2026-62968

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input

来源摘录 · NVD

#cve #cwe-88

漏洞预警2026-10-30 发布HIGH

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execu...

CVE-2026-62847

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.

来源摘录 · NVD

#cve #cwe-377 #cwe-427

漏洞预警2026-10-30 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Ve...

CVE-2026-62334

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x lin

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-30 发布INFO

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `reg...

CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `re

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with ...

CVE-2026-62284

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfi

来源摘录 · NVD

#cve #cwe-918 #cwe-94

漏洞预警2026-10-30 发布MEDIUM

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `...

CVE-2026-62254

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger a

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-30 发布MEDIUM

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating ...

CVE-2026-62250

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_pre

来源摘录 · NVD

#cve #cwe-400 #cwe-835

漏洞预警2026-10-30 发布INFO

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the at...

CVE-2026-62162

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/de

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the de...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布MEDIUM

sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination ...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z arch

来源摘录 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

CVE-2026-48201

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.

CVE-2026-28160

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-05-27 发布MEDIUM

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with und...

CVE-2026-1933

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to miss

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-07-07 发布HIGH

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allo...

CVE-2026-14476

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitiz

来源摘录 · NVD

#cve #cwe-23

漏洞预警2026-07-07 发布HIGH

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole obje...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD

来源摘录 · NVD

#cve #cwe-1188