#CVE

共收录 62800 条相关情报。

← 返回所有主题

漏洞预警2026-10-31 发布MEDIUM

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path element...

CVE-2026-120210

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-31 发布CRITICAL

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'data...

CVE-2026-120209

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-31 发布HIGH

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by s...

CVE-2026-120208

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::proces

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-31 发布HIGH

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office...

CVE-2026-120207

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to dele

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-31 发布MEDIUM

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens ...

CVE-2026-120206

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forg

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-31 发布HIGH

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped ...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows u

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-31 发布MEDIUM

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the out...

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows rem

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-31 发布HIGH

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attac...

CVE-2026-120203

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-31 发布MEDIUM

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_b...

CVE-2026-120202

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide mali

来源摘录 · NVD

#cve #cwe-693

漏洞预警2026-10-31 发布CRITICAL

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query condition...

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gai

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-31 发布MEDIUM

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via ses...

CVE-2026-120200

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate,

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-31 发布MEDIUM

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attacke...

CVE-2026-120199

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated u

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-31 发布INFO

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker t...

CVE-2026-102212

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console serv

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-31 发布HIGH

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, su...

CVE-2026-78192

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer

来源摘录 · NVD

#cve #cwe-1188 #cwe-540

漏洞预警2026-10-31 发布CRITICAL

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by match...

CVE-2026-78191

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne d

来源摘录 · NVD

#cve #cwe-777

漏洞预警2026-10-31 发布MEDIUM

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and ...

CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-31 发布CRITICAL

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file...

CVE-2026-78189

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-31 发布MEDIUM

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only...

CVE-2026-78188

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attrib

来源摘录 · NVD

#cve #cwe-1004 #cwe-1275 #cwe-614

漏洞预警2026-10-31 发布MEDIUM

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to i...

CVE-2026-15272

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' paramet

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-31 发布MEDIUM

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input san...

CVE-2026-96554

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions

来源摘录 · NVD

#cve #cwe-79