#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query r...

CVE-2026-118029

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) befor

来源摘录 · NVD

#cve #cwe-283

漏洞预警2026-10-28 发布HIGH

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who posse...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1,

来源摘录 · NVD

#cve #cwe-78 #cwe-862

漏洞预警2026-10-28 发布INFO

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in ...

CVE-2026-116776

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-28 发布HIGH

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer ...

CVE-2026-112357

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local pri

来源摘录 · NVD

#cve #cwe-276

漏洞预警2026-10-28 发布MEDIUM

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-28 发布HIGH

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be...

CVE-2026-93520

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-28 发布HIGH

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to...

CVE-2026-93519

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland b

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-28 发布HIGH

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1....

CVE-2026-93518

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients i

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-28 发布INFO

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.

CVE-2026-115402

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) vi

来源摘录 · NVD

#cve #cwe-362 #cwe-672

漏洞预警2026-10-28 发布HIGH

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustio...

CVE-2026-106972

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attack

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-28 发布HIGH

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack...

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attac

来源摘录 · NVD

#cve #cwe-190 #cwe-400

漏洞预警2026-10-28 发布INFO

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered...

CVE-2026-93517

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-28 发布INFO

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can cras...

CVE-2026-59959

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

来源摘录 · NVD

#cve #cwe-369

漏洞预警2026-10-28 发布HIGH

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/gi...

CVE-2026-59185

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-639 #cwe-862

漏洞预警2026-10-28 发布HIGH

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELE...

CVE-2026-59179

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0...

CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Ass

来源摘录 · NVD

#cve #cwe-1327

漏洞预警2026-10-28 发布HIGH

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `versi...

CVE-2026-59176

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-28 发布HIGH

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` director...

CVE-2026-59172

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint ` walks upward f

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-829

漏洞预警2026-10-28 发布HIGH

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authoriz...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/D...

CVE-2026-52729

Xibo is an open source digital signage platform with a web content management system and Windows display player software

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862