#CVE

共收录 56389 条相关情报。

漏洞预警2026-10-30 发布INFO

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the gly...

CVE-2026-61627

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. P

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-125 #cwe-787

漏洞预警2026-10-30 发布INFO

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guar...

CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Fro

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-787

漏洞预警2026-10-30 发布MEDIUM

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substitute...

CVE-2026-48164

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11,

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit...

CVE-2026-46499

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11,

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布HIGH

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unseriali...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `publ

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/...

CVE-2026-45141

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `sav

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布MEDIUM

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_Quick...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1,

来源摘录 · NVD

#cve #cwe-95

漏洞预警2026-10-30 发布INFO

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authentic...

CVE-2026-119682

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine S

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布INFO

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled...

CVE-2026-119680

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to i

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other pro...

CVE-2026-119665

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionVi

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied ...

CVE-2026-119664

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsM

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated us...

CVE-2026-119663

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connect

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin p...

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to au

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-30 发布MEDIUM

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry...

CVE-2026-119661

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布CRITICAL

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'm...

CVE-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admi

来源摘录 · NVD

#cve #cwe-1394

漏洞预警2026-10-30 发布MEDIUM

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on...

CVE-2026-119659

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other us

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by sup...

CVE-2026-119658

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role acco

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuse...

CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORD...

CVE-2026-119656

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPag

来源摘录 · NVD

#cve #cwe-89