#CVE

共收录 59371 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownershi...

CVE-2026-119547

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerabili

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the...

CVE-2026-119546

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in res

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the ...

CVE-2026-119545

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnera

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /co...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remov

来源摘录 · NVD

#cve #cwe-620

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to t

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Atta...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POS...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arb

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布MEDIUM

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafte...

CVE-2026-119423

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim

来源摘录 · NVD

#cve #cwe-117

漏洞预警2026-10-30 发布HIGH

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExp...

CVE-2026-119419

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidat

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布LOW

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID val...

CVE-2026-119415

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME par

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布HIGH

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users a...

CVE-2026-119407

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, all

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by s...

CVE-2026-119379

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node ...

CVE-2026-119378

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make appli

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布LOW

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to...

CVE-2026-119377

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers...

CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEP

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized pa...

CVE-2026-119375

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-c

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offs...

CVE-2026-119374

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to wr

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attacke...

CVE-2026-119373

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list...

CVE-2026-119372

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEP

来源摘录 · NVD

#cve #cwe-674