#CVE

共收录 63861 条相关情报。

漏洞预警2026-10-27 发布MEDIUM

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software a...

CVE-2026-105323

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field t...

CVE-2026-102800

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, w

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg ...

CVE-2026-117541

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash calle

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-10-27 发布HIGH

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unaut...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedl

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-27 发布LOW

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted S...

CVE-2026-117539

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow att

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rend...

CVE-2026-117538

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the func

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default...

CVE-2026-117537

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inje

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布HIGH

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the sa...

CVE-2026-117536

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML esca...

CVE-2026-117535

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, wher

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalid...

CVE-2026-117534

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows att

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布INFO

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sani...

CVE-2026-117533

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves up

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布CRITICAL

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary log...

CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin tha

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-27 发布MEDIUM

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

CVE-2026-117530

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted command

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-27 发布INFO

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

CVE-2026-117466

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full s

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布INFO

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that sp...

CVE-2026-117341

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. Wh

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, li...

CVE-2026-116900

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article ...

CVE-2026-116899

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices i

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布INFO

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authen...

CVE-2026-116898

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布MEDIUM

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or cl...

CVE-2026-116897

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-27 发布HIGH

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] ...

CVE-2026-116896

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database

来源摘录 · NVD

#cve #cwe-862