#CVE

共收录 62105 条相关情报。

漏洞预警2026-10-30 发布INFO

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without pa...

CVE-2026-62965

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py`

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-22

漏洞预警2026-10-30 发布HIGH

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` pr...

CVE-2026-62958

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host

来源摘录 · NVD

#cve #cwe-125 #cwe-20

漏洞预警2026-10-30 发布HIGH

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses...

CVE-2026-62864

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-para

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布CRITICAL

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate ...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its

来源摘录 · NVD

#cve #cwe-306 #cwe-942

漏洞预警2026-10-30 发布MEDIUM

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discr...

CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint

来源摘录 · NVD

#cve #cwe-208

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandb...

CVE-2026-62853

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-s

来源摘录 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values s...

CVE-2026-62849

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengin

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integrati...

CVE-2026-62848

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 202

来源摘录 · NVD

#cve #cwe-502 #cwe-913

漏洞预警2026-10-30 发布HIGH

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execu...

CVE-2026-62847

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.

来源摘录 · NVD

#cve #cwe-377 #cwe-427

漏洞预警2026-10-30 发布MEDIUM

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/fil...

CVE-2026-62300

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-30 发布HIGH

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Before the allocation-limit remediation attempt in version 31.0.0, `readPsd()` commits image and...

CVE-2026-62297

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Before the allocation-limit remediation

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-30 发布MEDIUM

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `...

CVE-2026-62254

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger a

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-30 发布MEDIUM

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating ...

CVE-2026-62250

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_pre

来源摘录 · NVD

#cve #cwe-400 #cwe-835

漏洞预警2026-10-30 发布MEDIUM

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `c...

CVE-2026-59993

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affecte

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-30 发布HIGH

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/b...

CVE-2026-58412

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the uplo

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布LOW

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const...

CVE-2026-54610

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-471 #cwe-703

漏洞预警2026-10-30 发布HIGH

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory ...

CVE-2026-40573

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` in

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-250

漏洞预警2026-10-30 发布MEDIUM

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attac...

CVE-2026-119343

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST

来源摘录 · NVD

#cve #cwe-73 #cwe-918

漏洞预警2026-10-30 发布MEDIUM

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders at...

CVE-2026-119342

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.1

来源摘录 · NVD

#cve #cwe-20 #cwe-22 #cwe-610 #cwe-918

漏洞预警2026-10-30 发布LOW

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without...

CVE-2026-119341

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT

来源摘录 · NVD

#cve #cwe-763