#CVE

共收录 56389 条相关情报。

漏洞预警2026-10-31 发布MEDIUM

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component A...

CVE-2026-120185

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the fi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-266 #cwe-269 #severity:medium

漏洞预警2026-10-31 发布HIGH

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, w...

CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-674 #severity:high

漏洞预警2026-10-31 发布CRITICAL

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application...

CVE-2026-118636

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-31 发布HIGH

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-118147

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-295 #severity:high

漏洞预警2026-10-31 发布MEDIUM

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path element...

CVE-2026-120210

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-31 发布CRITICAL

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'data...

CVE-2026-120209

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-321 #severity:critical

漏洞预警2026-10-31 发布HIGH

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by s...

CVE-2026-120208

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::proces

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-122 #severity:high

漏洞预警2026-10-31 发布HIGH

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office...

CVE-2026-120207

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to dele

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-352 #severity:high

漏洞预警2026-10-31 发布MEDIUM

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens ...

CVE-2026-120206

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forg

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-352 #severity:medium

漏洞预警2026-10-31 发布HIGH

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped ...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows u

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布MEDIUM

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the out...

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows rem

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-31 发布HIGH

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attac...

CVE-2026-120203

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-94 #severity:high

漏洞预警2026-10-31 发布HIGH

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_b...

CVE-2026-120202

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide mali

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-693 #severity:high

漏洞预警2026-10-31 发布CRITICAL

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query condition...

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gai

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-943 #severity:critical

漏洞预警2026-10-31 发布MEDIUM

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via ses...

CVE-2026-120200

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate,

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attacke...

CVE-2026-120199

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated u

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-31 发布HIGH

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker t...

CVE-2026-102212

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console serv

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-122 #severity:high

漏洞预警2026-10-31 发布INFO

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, su...

CVE-2026-78192

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-540

漏洞预警2026-10-31 发布INFO

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by match...

CVE-2026-78191

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne d

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-777

漏洞预警2026-10-31 发布INFO

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and ...

CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79