2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-08-20 发布HIGH

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services,...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Direct

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-30 发布HIGH

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models direct...

CVE-2026-119979

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with cert...

CVE-2026-119727

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream con

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-30 发布MEDIUM

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length check...

CVE-2026-119721

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in r

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cm...

CVE-2026-119288

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Win

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布MEDIUM

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due ...

CVE-2026-119176

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' pa

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (...

CVE-2026-119113

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is d...

CVE-2026-119087

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypa

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versio...

CVE-2026-119059

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capabi

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dum...

CVE-2026-118992

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configur

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布MEDIUM

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, ...

CVE-2026-118635

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布MEDIUM

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient ...

CVE-2026-118634

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布HIGH

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7...

CVE-2026-118205

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privile

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布MEDIUM

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post...

CVE-2026-118194

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inc

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-29 发布MEDIUM

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: f...

CVE-2026-118091

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Acces

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

CVE-2026-118085

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布MEDIUM

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

CVE-2026-118084

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-29 发布HIGH

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

CVE-2026-118083

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-29 发布HIGH

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

CVE-2026-118082

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-29 发布HIGH

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

CVE-2026-118079

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

来源摘录 · NVD

#cve #cwe-502