#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-28 发布HIGH

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder pa...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticate

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布MEDIUM

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished dra...

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canv...

CVE-2026-118753

FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in P

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-28 发布HIGH

FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds che...

CVE-2026-118752

FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in t

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-28 发布HIGH

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. ...

CVE-2026-118694

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by sub

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-28 发布MEDIUM

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML...

CVE-2026-118693

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trus

来源摘录 · NVD

#cve #cwe-36

漏洞预警2026-10-28 发布HIGH

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in...

CVE-2026-118692

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布LOW

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from...

CVE-2026-118691

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint th

来源摘录 · NVD

#cve #cwe-1188

漏洞预警2026-10-28 发布CRITICAL

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs end...

CVE-2026-118690

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attacke

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-28 发布HIGH

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payloa...

CVE-2026-118689

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthe

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-28 发布HIGH

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certi...

CVE-2026-118682

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing att

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-28 发布INFO

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant hand...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Render...

CVE-2026-118538

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTr

来源摘录 · NVD

#cve #cwe-913 #cwe-915

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Vide...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catal

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-28 发布MEDIUM

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal de...

CVE-2026-116641

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. Howe

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-28 发布INFO

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handler...

CVE-2026-118668

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or Typ

来源摘录 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-10-28 发布MEDIUM

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4...

CVE-2026-118667

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs fro

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLeg...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the Gr

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布INFO

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLeg...

CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the Gr

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-28 发布HIGH

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in ind

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #cwe-407 #npm #severity:high