#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the defa...

CVE-2026-118653

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Re

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that pas...

CVE-2026-118652

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated ca

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExt...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP hea

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-28 发布HIGH

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because...

CVE-2026-118650

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an en

来源摘录 · NVD

#cve #cwe-177 #cwe-863

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as th

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-28 发布CRITICAL

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model iden...

CVE-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by su

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-28 发布MEDIUM

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environ...

CVE-2026-115415

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 mig

来源摘录 · NVD

#cve

漏洞预警2026-10-28 发布HIGH

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite rest...

CVE-2026-109411

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated

来源摘录 · NVD

#cve #cwe-178

漏洞预警2026-10-28 发布HIGH

Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this...

CVE-2025-14260

Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBS...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to

来源摘录 · NVD

#cve #cwe-61

漏洞预警2026-10-28 发布MEDIUM

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity J...

CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does n

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-28 发布HIGH

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling cons...

CVE-2026-118686

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布MEDIUM

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level s...

CVE-2026-118685

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the str

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布MEDIUM

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash t...

CVE-2026-118684

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns T

来源摘录 · NVD

#cve #cwe-327

漏洞预警2026-10-28 发布HIGH

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfi...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-28 发布LOW

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter ...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-28 发布MEDIUM

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBAL...

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Sla...

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows w...

CVE-2026-118678

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布MEDIUM

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently r...

CVE-2026-118677

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop ap

来源摘录 · NVD

#cve #cwe-939