#advisory

共收录 22911 条相关情报。

← 返回所有主题
漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access...

CVE-2026-116755

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (h...

CVE-2026-77152

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collecti

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111477

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

安全公告2026-10-30 发布HIGH

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

CVE-2026-118761

## Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expand

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

CVE-2026-118759

## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

CVE-2026-119203

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires openi

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage when parsing page tree

CVE-2026-119204

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible infinite loop when cloning dictionaries

CVE-2026-119205

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloni

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

CVE-2026-118772

### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

CVE-2026-119202

### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token w

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布MEDIUM

minimatch has potential denial of service via globparts amplification

CVE-2026-118764

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布MEDIUM

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

CVE-2026-118773

### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directori

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

Authlib RFC 7592 examples omit registration-access-token client binding

CVE-2026-116672

## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously regi

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible long runtimes when retrieving page labels

CVE-2026-119206

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retriev

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage for exceptions in strict mode

CVE-2026-119207

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loa

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible long runtimes/large memory usage for encrypted PDF files

CVE-2026-119208

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This req

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage when parsing cross-reference streams

CVE-2026-119209

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires ope

来源摘录 · GitHub Advisory