#CVE

共收录 59371 条相关情报。

漏洞预警2026-10-30 发布LOW

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cm...

CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute deni

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-30 发布MEDIUM

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to ...

CVE-2026-119566

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google I

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications...

CVE-2026-119565

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that al

来源摘录 · NVD

#cve #cwe-915

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer I...

CVE-2026-119564

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site edit

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in Desi...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE pri

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /data...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supply

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-89

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures a...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionRespo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布MEDIUM

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge a...

CVE-2026-119560

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布MEDIUM

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements ov...

CVE-2026-119559

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-30 发布LOW

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free...

CVE-2026-119558

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-pr

来源摘录 · NVD

#cve #cwe-841

漏洞预警2026-10-30 发布MEDIUM

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints b...

CVE-2026-119557

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticate

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web s...

CVE-2026-119556

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_fee...

CVE-2026-119555

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an inform

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin...

CVE-2026-119554

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injectio

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format...

CVE-2026-119553

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path travers

来源摘录 · NVD

#cve #cwe-23

漏洞预警2026-10-30 发布MEDIUM

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account....

CVE-2026-119552

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated

来源摘录 · NVD

#cve #cwe-367

漏洞预警2026-10-30 发布MEDIUM

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library ...

CVE-2026-119551

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布LOW

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting p...

CVE-2026-119550

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows au

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG ...

CVE-2026-119549

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecur

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布LOW

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invo...

CVE-2026-119548

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows user

来源摘录 · NVD

#cve #cwe-639