#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-30 发布HIGH

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` ...

CVE-2026-63184

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet to

来源摘录 · NVD

#cve #cwe-829 #cwe-918

漏洞预警2026-10-30 发布HIGH

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, Light...

CVE-2026-63182

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate suppo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布MEDIUM

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trus...

CVE-2026-63121

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-178

漏洞预警2026-10-30 发布MEDIUM

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service t...

CVE-2026-63115

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handle

来源摘录 · NVD

#cve #cwe-290 #cwe-345 #cwe-863

漏洞预警2026-10-30 发布INFO

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user ...

CVE-2026-62347

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `S

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-532

漏洞预警2026-10-30 发布MEDIUM

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` ch...

CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `Print

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `ch...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases heade

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arriv...

CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HT

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-444

漏洞预警2026-10-30 发布LOW

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX...

CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an in

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布MEDIUM

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 2...

CVE-2026-55147

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 1...

CVE-2026-55146

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_

来源摘录 · NVD

#cve #cwe-502 #cwe-693

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted qualname (for example "Values.read_file") is resolved by pickle's find_class throug...

CVE-2026-118938

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val

来源摘录 · NVD

#cve #cwe-502 #cwe-706

漏洞预警2026-10-30 发布HIGH

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billi...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php...

CVE-2026-62991

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show`

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a conte...

CVE-2026-62990

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1

来源摘录 · NVD

#cve #cwe-269 #cwe-79

漏洞预警2026-10-30 发布HIGH

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `De...

CVE-2026-62989

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Li

来源摘录 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-10-30 发布INFO

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP...

CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handl

来源摘录 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-30 发布INFO

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specifi...

CVE-2026-62968

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input

来源摘录 · NVD

#cve #cwe-88

漏洞预警2026-10-30 发布HIGH

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate anoth...

CVE-2026-62967

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenti

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862