2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing ...

CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-30 发布MEDIUM

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when ...

CVE-2026-119339

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata

来源摘录 · NVD

#cve #cwe-20 #cwe-617

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatechec...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

来源摘录 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/Li...

CVE-2026-119331

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet

来源摘录 · NVD

#cve #cwe-200 #cwe-346

漏洞预警2026-10-30 发布HIGH

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

CVE-2026-118086

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-30 发布HIGH

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

CVE-2026-116401

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.

CVE-2026-107868

Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-09-08 发布HIGH

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-69556

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-09-08 发布HIGH

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-69522

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-30 发布INFO

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribu...

CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV cr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can ...

CVE-2026-63201

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected ver

来源摘录 · NVD

#cve #cwe-134

漏洞预警2026-10-30 发布HIGH

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` ...

CVE-2026-63184

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet to

来源摘录 · NVD

#cve #cwe-829 #cwe-918

漏洞预警2026-10-30 发布HIGH

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, Light...

CVE-2026-63182

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate suppo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布MEDIUM

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trus...

CVE-2026-63121

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions

来源摘录 · NVD

#cve #cwe-178

漏洞预警2026-10-30 发布MEDIUM

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service t...

CVE-2026-63115

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handle

来源摘录 · NVD

#cve #cwe-290 #cwe-345 #cwe-863

漏洞预警2026-10-30 发布INFO

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user ...

CVE-2026-62347

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `S

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-30 发布MEDIUM

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` ch...

CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `Print

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `ch...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases heade

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arriv...

CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HT

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布LOW

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX...

CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an in

来源摘录 · NVD

#cve #cwe-444