#advisory

共收录 23093 条相关情报。

漏洞预警2026-10-28 发布LOW

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter ...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-288 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBAL...

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Sla...

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently r...

CVE-2026-118677

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop ap

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-939 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node pa...

CVE-2026-118676

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use c

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-wor...

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared w

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error response...

CVE-2026-118648

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability be

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw requ...

CVE-2026-118647

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error ex

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-532 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob ...

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authen

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1333 #severity:high

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error wor...

CVE-2026-118644

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-266 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, a...

CVE-2026-118643

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-209 #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workf...

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the ...

CVE-2026-118640

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:medium

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the con...

CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a clien

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-444 #cwe-863

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete resp...

CVE-2026-118260

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-400 #cwe-770

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. ...

CVE-2026-118255

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.hre

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. A...

CVE-2026-118254

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination l

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather tha...

CVE-2026-118252

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sid

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label i...

CVE-2026-118251

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns cre

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (C...

CVE-2026-106484

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker

来源摘录 · NVD / OSV.dev / GitHub Advisory

#advisory #cve #cwe-284 #severity:medium