#CVE

共收录 62105 条相关情报。

漏洞预警2026-10-30 发布INFO

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory doe

来源摘录 · NVD

#cve #cwe-611

漏洞预警2026-10-30 发布HIGH

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSR...

CVE-2026-59978

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?scrip

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

CVE-2026-54855

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

CVE-2026-54854

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-30 发布MEDIUM

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

CVE-2026-54850

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-w...

CVE-2026-52710

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#821

来源摘录 · NVD

#cve #cwe-80

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

CVE-2026-48201

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布HIGH

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first U...

CVE-2026-46560

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module op

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

CVE-2026-39786

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-element...

CVE-2026-39739

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force U

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布CRITICAL

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a...

CVE-2026-39738

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Inj

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

CVE-2026-39734

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

来源摘录 · NVD

#cve #cwe-35

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

CVE-2026-39732

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRent...

CVE-2026-28160

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCa

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

CVE-2026-27061

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a...

CVE-2026-120046

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-30 发布MEDIUM

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /registe...

CVE-2026-120007

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing ...

CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that ...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Par...

CVE-2026-119728

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or n

来源摘录 · NVD

#cve #cwe-476