#CVE

共收录 63078 条相关情报。

← 返回所有主题

漏洞预警2026-10-27 发布MEDIUM

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPa...

CVE-2026-115408

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-27 发布INFO

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external ...

CVE-2026-115216

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contac

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-27 发布INFO

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into...

CVE-2026-113644

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certifi

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布CRITICAL

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes ...

CVE-2026-112362

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-27 发布INFO

TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By ...

CVE-2026-10756

TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access s

来源摘录 · NVD

#cve #cwe-923

漏洞预警2026-10-27 发布MEDIUM

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not prop...

CVE-2026-10752

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, a

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布HIGH

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up...

CVE-2026-109995

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, incl...

CVE-2026-106087

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-27 发布MEDIUM

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software a...

CVE-2026-105323

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field t...

CVE-2026-102800

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, w

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg ...

CVE-2026-117541

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash calle

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-10-27 发布HIGH

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unaut...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedl

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-27 发布LOW

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted S...

CVE-2026-117539

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow att

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rend...

CVE-2026-117538

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the func

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default...

CVE-2026-117537

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inje

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布HIGH

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the sa...

CVE-2026-117536

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML esca...

CVE-2026-117535

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, wher

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalid...

CVE-2026-117534

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows att

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布INFO

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sani...

CVE-2026-117533

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves up

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布CRITICAL

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary log...

CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin tha

来源摘录 · NVD

#cve #cwe-287