#CVE

共收录 62800 条相关情报。

漏洞预警2026-10-31 发布HIGH

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formDat...

CVE-2026-109997

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-31 发布HIGH

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5...

CVE-2026-109234

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-31 发布HIGH

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access...

CVE-2026-116755

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-31 发布INFO

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-31 发布INFO

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (h...

CVE-2026-77152

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collecti

来源摘录 · NVD

#cve #cwe-285

漏洞预警2026-10-31 发布INFO

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impers...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth A

来源摘录 · NVD

#cve #cwe-290 #cwe-349

漏洞预警2026-10-30 发布INFO

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context...

CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticate

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_c...

CVE-2026-63410

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar

来源摘录 · NVD

#cve #cwe-1255 #cwe-208

漏洞预警2026-10-30 发布MEDIUM

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses ...

CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` che

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321 #cwe-471

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `...

CVE-2026-63401

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAc

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An ...

CVE-2026-63400

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the passwo

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary or...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operati

来源摘录 · NVD

#cve #cwe-306 #cwe-799

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUse...

CVE-2026-63398

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolv

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessib...

CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remot...

CVE-2026-63393

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 u

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a vali...

CVE-2026-63378

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布CRITICAL

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api...

CVE-2026-63377

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-306

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted ver...

CVE-2026-63346

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter nam

来源摘录 · NVD

#cve #cwe-116 #cwe-94