2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-29 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This iss...

CVE-2026-114706

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Te

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigge...

CVE-2026-114691

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attack...

CVE-2026-114690

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementa

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-22 发布MEDIUM

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user vi...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlie

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-22 发布MEDIUM

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string dur...

CVE-2026-114460

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an

来源摘录 · NVD

#cve #cwe-193

漏洞预警2026-10-21 发布MEDIUM

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signe...

CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-22 发布MEDIUM

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords fr...

CVE-2026-114223

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local a

来源摘录 · NVD

#cve #cwe-312

漏洞预警2026-10-22 发布MEDIUM

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, there...

CVE-2026-114222

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布HIGH

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an u...

CVE-2026-114221

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-21 发布HIGH

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment co...

CVE-2026-113870

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editabl

来源摘录 · NVD

#cve #cwe-116

漏洞预警2026-10-22 发布HIGH

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when a...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to

来源摘录 · NVD

#cve #cwe-611

漏洞预警2026-10-30 发布HIGH

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_le...

CVE-2026-112365

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vu

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布INFO

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), w...

CVE-2026-110974

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSON

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布HIGH

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due...

CVE-2026-110732

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorizatio

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This mak...

CVE-2026-110305

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all version

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布MEDIUM

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to,...

CVE-2026-110001

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (short

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 du...

CVE-2026-109984

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' param

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-29 发布MEDIUM

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issu...

CVE-2026-109891

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorr

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. T...

CVE-2026-109592

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorizati

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-113499. Reason: This candidate is a reservation duplicate of CVE-2026-113499. Notes: All CVE...

CVE-2026-109213

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-113499. Reason: This candidate is a

来源摘录 · NVD

#cve