#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Atta...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POS...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arb

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布MEDIUM

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding ...

CVE-2026-119424

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with w

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布MEDIUM

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafte...

CVE-2026-119423

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim

来源摘录 · NVD

#cve #cwe-117

漏洞预警2026-10-30 发布HIGH

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite m...

CVE-2026-119420

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain se

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-30 发布HIGH

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExp...

CVE-2026-119419

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidat

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies ...

CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection th

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-30 发布LOW

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID val...

CVE-2026-119415

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME par

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-30 发布HIGH

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes run...

CVE-2026-119408

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via depreca

来源摘录 · NVD

#cve #cwe-653

漏洞预警2026-10-30 发布HIGH

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users a...

CVE-2026-119407

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, all

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by s...

CVE-2026-119379

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node ...

CVE-2026-119378

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make appli

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布LOW

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to...

CVE-2026-119377

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers...

CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEP

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized pa...

CVE-2026-119375

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-c

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offs...

CVE-2026-119374

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to wr

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布HIGH

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attacke...

CVE-2026-119373

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list...

CVE-2026-119372

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEP

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布MEDIUM

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authent...

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that sk

来源摘录 · NVD

#cve #cwe-863