#CVE

共收录 62800 条相关情报。

漏洞预警2026-10-30 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Ve...

CVE-2026-62334

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x lin

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-30 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleA...

CVE-2026-62333

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x lin

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-20

漏洞预警2026-10-30 发布INFO

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `reg...

CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `re

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only ...

CVE-2026-62301

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with ...

CVE-2026-62284

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfi

来源摘录 · NVD

#cve #cwe-918 #cwe-94

漏洞预警2026-10-30 发布INFO

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an auth...

CVE-2026-61850

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authori

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布LOW

go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/...

CVE-2026-61694

go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-30 发布CRITICAL

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword...

CVE-2026-61620

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other a

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before ellip...

CVE-2026-61618

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-20

漏洞预警2026-10-30 发布CRITICAL

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `PO...

CVE-2026-55598

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commen...

CVE-2026-55493

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database autho...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the reme

来源摘录 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack o...

CVE-2026-119730

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers

来源摘录 · NVD

#cve #cwe-451

漏洞预警2026-10-30 发布HIGH

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns throu...

CVE-2026-119337

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/cha

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatechec...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

来源摘录 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts t...

CVE-2026-119335

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-78

漏洞预警2026-10-30 发布LOW

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability wit...

CVE-2026-119334

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron...

CVE-2026-119333

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell

来源摘录 · NVD

#cve #cwe-426

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.c...

CVE-2026-119332

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cl

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布HIGH

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/Li...

CVE-2026-119331

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet

来源摘录 · NVD

#cve #cwe-200 #cwe-346