2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布MEDIUM

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /registe...

CVE-2026-120007

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and le...

CVE-2026-119777

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that ...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, t...

CVE-2026-119728

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-30 发布HIGH

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns throu...

CVE-2026-119337

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/cha

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts t...

CVE-2026-119335

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布LOW

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability wit...

CVE-2026-119334

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron...

CVE-2026-119333

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell

来源摘录 · NVD

#cve #cwe-426

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.c...

CVE-2026-119332

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cl

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布LOW

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in...

CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation A

来源摘录 · NVD

#cve #cwe-285

漏洞预警2026-10-30 发布MEDIUM

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner i...

CVE-2026-119329

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_m...

CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machin

来源摘录 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-30 发布HIGH

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWOR...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrot

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-214 #cwe-526 #severity:high

漏洞预警2026-10-30 发布HIGH

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or clie...

CVE-2026-116245

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-522 #cwe-862 #severity:high

漏洞预警2026-10-30 发布HIGH

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to t...

CVE-2026-116244

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME fro

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under ...

CVE-2026-116243

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-426 #cwe-427 #severity:high

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh ...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers t...

CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #cwe-367 #severity:high

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerbe...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-287 #cwe-639 #severity:high

漏洞预警2026-10-30 发布CRITICAL

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unli...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit coul

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-307 #cwe-863 #severity:critical