Cyber Security Daily Radar

#CVE

共收录 63078 条相关情报。

← 返回所有主题
漏洞预警2026-10-30 发布INFO

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actua...

CVE-2026-61840

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates

来源摘录 · NVD / OSV.dev

#advisory#cve#cwe-918
漏洞预警2026-10-30 发布INFO

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory doe

来源摘录 · NVD

#cve#cwe-611
漏洞预警2026-10-30 发布HIGH

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSR...

CVE-2026-59978

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?scrip

来源摘录 · NVD

#cve#cwe-20
漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

CVE-2026-54855

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布MEDIUM

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

CVE-2026-54854

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

来源摘录 · NVD

#cve#cwe-266
漏洞预警2026-10-30 发布MEDIUM

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

CVE-2026-54850

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

来源摘录 · NVD

#cve#cwe-862
漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce ithemeland-free-gifts-for-w...

CVE-2026-52710

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#821

来源摘录 · NVD

#cve#cwe-80
漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

CVE-2026-48201

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布HIGH

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first U...

CVE-2026-46560

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module op

来源摘录 · NVD

#cve#cwe-347
漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

CVE-2026-39786

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-element...

CVE-2026-39739

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force U

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布CRITICAL

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a...

CVE-2026-39738

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Inj

来源摘录 · NVD

#cve#cwe-502
漏洞预警2026-10-30 发布HIGH

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

CVE-2026-39734

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

来源摘录 · NVD

#cve#cwe-35
漏洞预警2026-10-30 发布CRITICAL

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

CVE-2026-39732

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

来源摘录 · NVD

#cve#cwe-89
漏洞预警2026-10-30 发布HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRent...

CVE-2026-28160

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCa

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布MEDIUM

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

CVE-2026-27061

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

来源摘录 · NVD

#cve#cwe-79
漏洞预警2026-10-30 发布MEDIUM

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a...

CVE-2026-120046

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows

来源摘录 · NVD

#cve#cwe-476
漏洞预警2026-10-30 发布MEDIUM

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /registe...

CVE-2026-120007

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act

来源摘录 · NVD

#cve#cwe-639
漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing ...

CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle

来源摘录 · NVD

#cve#cwe-476
漏洞预警2026-10-30 发布MEDIUM

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that ...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows

来源摘录 · NVD

#cve#cwe-190