#CVE

共收录 63078 条相关情报。

← 返回所有主题

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL wit...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently reje...

CVE-2026-118767

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containi

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-158

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Autho...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while po

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布INFO

socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.

CVE-2026-116566

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be

来源摘录 · NVD

#cve #cwe-158

漏洞预警2026-10-29 发布HIGH

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outs...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布MEDIUM

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read p...

CVE-2026-102260

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API e

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-29 发布HIGH

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, si...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and e

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-176 #cwe-754 #npm #severity:high

漏洞预警2026-10-29 发布HIGH

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

CVE-2026-11587

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-89

漏洞预警2026-10-29 发布HIGH

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user ...

CVE-2026-119115

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer)

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the ge...

CVE-2026-118765

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-335

漏洞预警2026-10-29 发布INFO

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhase...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.

来源摘录 · NVD

#cve #cwe-405

漏洞预警2026-10-29 发布HIGH

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that sto...

CVE-2026-118763

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/regis

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-522 #npm #severity:high

漏洞预警2026-10-29 发布CRITICAL

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write ...

CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml wo

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives witho...

CVE-2026-118761

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-409 #go #severity:high

漏洞预警2026-10-29 发布MEDIUM

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether a...

CVE-2026-118760

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.1

来源摘录 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{nod...

CVE-2026-118759

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-200 #cwe-862 #go #severity:high

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=vo...

CVE-2026-118758

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-29 发布HIGH

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires exi...

CVE-2026-115805

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local use

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布CRITICAL

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

CVE-2026-107060

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to anoth

来源摘录 · NVD

#cve #cwe-732

漏洞预警2026-10-29 发布HIGH

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authenticat...

CVE-2026-107059

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch

来源摘录 · NVD

#cve #cwe-926