2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-30 发布MEDIUM

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors heade...

CVE-2026-119715

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interfac

来源摘录 · NVD

#cve #cwe-1021

漏洞预警2026-10-30 发布MEDIUM

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs ...

CVE-2026-119714

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticate

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布HIGH

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布MEDIUM

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal ad...

CVE-2026-119712

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For o...

CVE-2026-119711

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-348

漏洞预警2026-10-30 发布HIGH

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting int...

CVE-2026-119710

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only th

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata...

CVE-2026-119709

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata P

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布HIGH

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated auth...

CVE-2026-119707

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write rout

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because ...

CVE-2026-119705

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthen

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布MEDIUM

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside...

CVE-2026-119704

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allow

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypa...

CVE-2026-119702

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthe

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmai...

CVE-2026-119701

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood pa

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. At...

CVE-2026-119700

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determ

来源摘录 · NVD

#cve #cwe-204

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the...

CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticat

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied ...

CVE-2026-119664

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsM

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated us...

CVE-2026-119663

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connect

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin p...

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to au

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-30 发布MEDIUM

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry...

CVE-2026-119661

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on...

CVE-2026-119659

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other us

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by sup...

CVE-2026-119658

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role acco

来源摘录 · NVD

#cve #cwe-639