2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-30 发布MEDIUM

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autoc...

CVE-2026-119653

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend l...

CVE-2026-119652

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by ...

CVE-2026-119651

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings...

CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows au

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contri...

CVE-2026-119649

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolder

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/...

CVE-2026-119648

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction rep...

CVE-2026-119646

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other s

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access check...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated us

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture...

CVE-2026-119644

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to mo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unva...

CVE-2026-119599

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-le

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-30 发布MEDIUM

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' confi...

CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs t

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. ...

CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authentic

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications...

CVE-2026-119565

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that al

来源摘录 · NVD

#cve #cwe-915

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer I...

CVE-2026-119564

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site edit

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-30 发布MEDIUM

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge a...

CVE-2026-119560

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布MEDIUM

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements ov...

CVE-2026-119559

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-30 发布MEDIUM

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account....

CVE-2026-119552

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated

来源摘录 · NVD

#cve #cwe-367

漏洞预警2026-10-30 发布LOW

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invo...

CVE-2026-119548

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows user

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-29 发布HIGH

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers...

CVE-2026-119325

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_po

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by om...

CVE-2026-112348

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-693