#CVE

共收录 56557 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal ad...

CVE-2026-119712

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For o...

CVE-2026-119711

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-348

漏洞预警2026-10-30 发布HIGH

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting int...

CVE-2026-119710

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only th

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata...

CVE-2026-119709

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata P

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants...

CVE-2026-119708

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated auth...

CVE-2026-119707

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write rout

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布CRITICAL

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remot

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布MEDIUM

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because ...

CVE-2026-119705

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthen

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布MEDIUM

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside...

CVE-2026-119704

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allow

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布MEDIUM

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HM...

CVE-2026-119703

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypa...

CVE-2026-119702

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthe

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmai...

CVE-2026-119701

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood pa

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. At...

CVE-2026-119700

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determ

来源摘录 · NVD

#cve #cwe-204

漏洞预警2026-10-30 发布MEDIUM

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the...

CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticat

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects ...

CVE-2026-119479

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder

来源摘录 · NVD

#cve #cwe-80

漏洞预警2026-10-30 发布MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Store...

CVE-2026-119369

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, wri...

CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect s

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJ...

CVE-2026-119290

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered repor

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a d...

CVE-2026-119289

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...)

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-30 发布HIGH

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cm...

CVE-2026-119288

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Win

来源摘录 · NVD

#cve #cwe-78