#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-30 发布HIGH

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWOR...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrot

来源摘录 · NVD

#cve #cwe-214 #cwe-526

漏洞预警2026-10-30 发布CRITICAL

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or clie...

CVE-2026-116245

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry

来源摘录 · NVD

#cve #cwe-522 #cwe-862

漏洞预警2026-10-30 发布CRITICAL

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to t...

CVE-2026-116244

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME fro

来源摘录 · NVD

#cve #cwe-1188 #cwe-522

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under ...

CVE-2026-116243

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server

来源摘录 · NVD

#cve #cwe-426 #cwe-427

漏洞预警2026-10-30 发布CRITICAL

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh ...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so

来源摘录 · NVD

#cve #cwe-1188 #cwe-522

漏洞预警2026-10-30 发布HIGH

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape ...

CVE-2026-116241

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the que

来源摘录 · NVD

#cve #cwe-115 #cwe-78

漏洞预警2026-10-30 发布MEDIUM

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers t...

CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds

来源摘录 · NVD

#cve #cwe-22 #cwe-367

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerbe...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an

来源摘录 · NVD

#cve #cwe-287 #cwe-639

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unli...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit coul

来源摘录 · NVD

#cve #cwe-307 #cwe-863

漏洞预警2026-10-30 发布INFO

In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

CVE-2026-115830

In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布INFO

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the ini...

CVE-2026-115829

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-30 发布INFO

In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device

CVE-2026-115828

In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

CVE-2026-94175

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVE-2026-90888

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-30 发布MEDIUM

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during cont...

CVE-2026-7005

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows at

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-346 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitra...

CVE-2026-7004

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allow

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-30 发布MEDIUM

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values ...

CVE-2026-7003

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-30 发布HIGH

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

CVE-2026-78527

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high

漏洞预警2026-10-30 发布MEDIUM

Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the...

CVE-2026-73322

Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is e

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布HIGH

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

CVE-2026-73186

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high