#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to ser...

CVE-2026-118577

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the c

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111575

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-28 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111486

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-28 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111478

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-28 发布HIGH

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an ...

CVE-2026-93851

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Age

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_qu...

CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI`

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, ...

CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after o...

CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/func

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `v...

CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control

来源摘录 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Str...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passe

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布CRITICAL

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login:...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an a

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布CRITICAL

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.p

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-28 发布INFO

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_ser...

CVE-2026-61546

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard appli

来源摘录 · NVD

#cve #cwe-346 #cwe-350

漏洞预警2026-10-28 发布INFO

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `...

CVE-2026-57448

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the adm

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `ho...

CVE-2026-54455

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

来源摘录 · NVD

#cve #cwe-20 #cwe-89

漏洞预警2026-10-28 发布HIGH

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration ...

CVE-2026-54453

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

来源摘录 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-28 发布HIGH

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post...

CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_r...

CVE-2026-118803

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-28 发布MEDIUM

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthe...

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerab

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ ent...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to

来源摘录 · NVD

#cve #cwe-22