#CVE

共收录 58490 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin...

CVE-2026-119554

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injectio

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format...

CVE-2026-119553

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path travers

来源摘录 · NVD

#cve #cwe-23

漏洞预警2026-10-30 发布MEDIUM

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account....

CVE-2026-119552

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated

来源摘录 · NVD

#cve #cwe-367

漏洞预警2026-10-30 发布MEDIUM

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library ...

CVE-2026-119551

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布LOW

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting p...

CVE-2026-119550

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows au

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG ...

CVE-2026-119549

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecur

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布LOW

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invo...

CVE-2026-119548

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows user

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownershi...

CVE-2026-119547

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerabili

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the...

CVE-2026-119546

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in res

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the ...

CVE-2026-119545

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnera

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /co...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remov

来源摘录 · NVD

#cve #cwe-620

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to t

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Atta...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POS...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arb

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布LOW

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID val...

CVE-2026-119415

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME par

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布HIGH

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users a...

CVE-2026-119407

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, all

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by s...

CVE-2026-119379

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node ...

CVE-2026-119378

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make appli

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布LOW

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to...

CVE-2026-119377

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers...

CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEP

来源摘录 · NVD

#cve #cwe-674