#CVE

共收录 63078 条相关情报。

← 返回所有主题
漏洞预警2026-10-27 发布HIGH

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked wit...

CVE-2026-116689

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16

来源摘录 · NVD / GitHub Advisory / OSV.dev

漏洞预警2026-10-27 发布HIGH

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype...

CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the en

来源摘录 · NVD

漏洞预警2026-10-27 发布LOW

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when ...

CVE-2026-116687

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specia

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSession...

CVE-2026-116686

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, strea...

CVE-2026-116685

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentic...

CVE-2026-116684

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through...

CVE-2026-112355

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauth

来源摘录 · NVD

漏洞预警2026-10-27 发布CRITICAL

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session ...

CVE-2026-112352

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote att

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account t...

CVE-2026-112351

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allow

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with...

CVE-2026-112350

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unau

来源摘录 · NVD

漏洞预警2026-10-27 发布INFO

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

CVE-2026-103995

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpret

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver...

CVE-2026-118180

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response wit

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured ne...

CVE-2026-118179

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and p

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location ...

CVE-2026-118178

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription

来源摘录 · NVD

漏洞预警2026-10-27 发布CRITICAL

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other serv...

CVE-2026-118177

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thund

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially c...

CVE-2026-118176

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed

来源摘录 · NVD

漏洞预警2026-10-27 发布HIGH

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being co...

CVE-2026-118175

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different me

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the ...

CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's con

来源摘录 · NVD

漏洞预警2026-10-27 发布INFO

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes c...

CVE-2026-118173

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for requ

来源摘录 · NVD

漏洞预警2026-10-27 发布MEDIUM

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redir...

CVE-2026-118172

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect

来源摘录 · NVD