2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布HIGH

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

CVE-2026-115830

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:high

漏洞预警2026-10-30 发布MEDIUM

In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device

CVE-2026-115828

In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when usi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-284 #severity:medium

漏洞预警2026-10-23 发布LOW

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root t...

CVE-2026-115569

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-

来源摘录 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-22 发布HIGH

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation s...

CVE-2026-115419

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScr

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-22 发布MEDIUM

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses...

CVE-2026-114655

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vaul

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-22 发布MEDIUM

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypa...

CVE-2026-114654

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subty

来源摘录 · NVD

#cve #cwe-681

漏洞预警2026-10-22 发布MEDIUM

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern express...

CVE-2026-114653

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers

来源摘录 · NVD

#cve #cwe-185

漏洞预警2026-10-22 发布MEDIUM

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as que...

CVE-2026-114652

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can c

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-22 发布MEDIUM

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when speciall...

CVE-2026-114651

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-22 发布INFO

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's ...

CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-30 发布MEDIUM

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict ver...

CVE-2026-114572

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentica

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-22 发布HIGH

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0...

CVE-2026-114510

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multip

来源摘录 · NVD

#cve #cwe-116 #cwe-943

漏洞预警2026-10-22 发布MEDIUM

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-adminis...

CVE-2026-114487

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 20

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset va...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/pa

来源摘录 · NVD

#cve #cwe-409 #cwe-770

漏洞预警2026-10-21 发布HIGH

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented A...

CVE-2026-114123

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metad

来源摘录 · NVD

#cve #cwe-1188 #cwe-306

漏洞预警2026-10-20 发布HIGH

Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted ...

CVE-2026-113264

Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-26 发布HIGH

An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be...

CVE-2026-112677

An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布MEDIUM

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109763

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunde

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from ...

CVE-2026-107259

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code I

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-30 发布MEDIUM

Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: ..

CVE-2026-107253

Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

来源摘录 · NVD

#cve