#CVE

共收录 62105 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commen...

CVE-2026-55493

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database autho...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the reme

来源摘录 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack o...

CVE-2026-119730

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers

来源摘录 · NVD

#cve #cwe-451

漏洞预警2026-10-30 发布HIGH

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns throu...

CVE-2026-119337

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/cha

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatechec...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

来源摘录 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts t...

CVE-2026-119335

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-78

漏洞预警2026-10-30 发布LOW

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability wit...

CVE-2026-119334

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron...

CVE-2026-119333

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell

来源摘录 · NVD

#cve #cwe-426

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.c...

CVE-2026-119332

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cl

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/Li...

CVE-2026-119331

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet

来源摘录 · NVD

#cve #cwe-200 #cwe-346

漏洞预警2026-10-30 发布LOW

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in...

CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation A

来源摘录 · NVD

#cve #cwe-285

漏洞预警2026-10-30 发布MEDIUM

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner i...

CVE-2026-119329

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_m...

CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machin

来源摘录 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-30 发布MEDIUM

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// U...

CVE-2026-116252

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre

来源摘录 · NVD

#cve #cwe-522 #cwe-88 #cwe-918

漏洞预警2026-10-30 发布MEDIUM

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting i...

CVE-2026-116251

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own chang

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布MEDIUM

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it ...

CVE-2026-116250

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permissio

来源摘录 · NVD

#cve #cwe-367 #cwe-59

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_fil...

CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relat

来源摘录 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-30 发布MEDIUM

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints ...

CVE-2026-116248

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Sha

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布CRITICAL

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the con...

CVE-2026-116247

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one coul

来源摘录 · NVD

#cve #cwe-1188 #cwe-522

漏洞预警2026-10-30 发布HIGH

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWOR...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrot

来源摘录 · NVD

#cve #cwe-214 #cwe-526