2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-22 发布HIGH

Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could ...

CVE-2026-79879

Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthen

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-22 发布HIGH

A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker s...

CVE-2026-79878

A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauth

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-10-22 发布HIGH

A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected devi...

CVE-2026-79877

A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjace

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-19 发布MEDIUM

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user ...

CVE-2026-68482

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenti

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_s...

CVE-2026-62337

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Ve...

CVE-2026-62335

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x lin

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleA...

CVE-2026-62333

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x lin

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布HIGH

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `inte...

CVE-2026-62331

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Contro

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布INFO

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only ...

CVE-2026-62301

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an auth...

CVE-2026-61850

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authori

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布INFO

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounde...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass conve

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-30 发布INFO

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before ellip...

CVE-2026-61618

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Meta Data). Supported versions that are affected are 8.61-8.63. Easily exploitab...

CVE-2026-60881

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Meta Data). Supported v

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布HIGH

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSR...

CVE-2026-59978

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?scrip

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布MEDIUM

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authenti...

CVE-2026-59396

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-30 发布HIGH

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v...

CVE-2026-59387

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ en

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-30 发布MEDIUM

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commen...

CVE-2026-55493

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database autho...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the reme

来源摘录 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-22 发布MEDIUM

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft....

CVE-2026-54532

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workfl

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-23 发布MEDIUM

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on t...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerab

来源摘录 · NVD

#cve #cwe-204