2026-10-31 归档

今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-29 发布MEDIUM

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

CVE-2026-107023

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrari

来源摘录 · NVD

#cve #cwe-732

漏洞预警2026-10-21 发布INFO

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopi...

CVE-2026-105927

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query paramete

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new sch...

CVE-2026-105926

The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including,...

CVE-2026-105894

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to P

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-21 发布INFO

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with toke...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON We

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-22 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and c...

CVE-2026-105270

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthent

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布INFO

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_e...

CVE-2026-104948

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticate...

CVE-2026-104947

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in fu

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due...

CVE-2026-104744

The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' p

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupport...

CVE-2026-104739

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion d

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, ...

CVE-2026-104623

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE R

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-26 发布MEDIUM

libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.

CVE-2026-104592

libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allo

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-30 发布MEDIUM

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the ...

CVE-2026-102918

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low pr...

CVE-2026-101364

Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticate...

CVE-2026-101363

Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated ...

CVE-2026-101362

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged a...

CVE-2026-101361

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布MEDIUM

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged att...

CVE-2026-101360

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-30 发布HIGH

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database...

CVE-2025-8574

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including

来源摘录 · NVD

#cve #cwe-284

漏洞预警2025-07-02 发布MEDIUM

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivil...

CVE-2025-6017

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2

来源摘录 · NVD

#cve #cwe-359