#CVE

共收录 63886 条相关情报。

漏洞预警2026-10-26 发布MEDIUM

A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can...

CVE-2026-116384

A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown co

来源摘录 · NVD

#cve #cwe-266 #cwe-285

漏洞预警2026-10-26 发布CRITICAL

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a...

CVE-2026-116370

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the funct

来源摘录 · NVD

#cve #cwe-843

漏洞预警2026-10-26 发布MEDIUM

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attentio...

CVE-2026-115913

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder i

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-26 发布HIGH

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in pub...

CVE-2026-115912

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place fo

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #pip #severity:high

漏洞预警2026-10-26 发布MEDIUM

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-...

CVE-2026-115911

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can s

来源摘录 · NVD

#cve #cwe-400 #cwe-770 #cwe-834

漏洞预警2026-10-26 发布MEDIUM

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce t...

CVE-2026-115910

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_co

来源摘录 · NVD

#cve #cwe-345 #cwe-384

漏洞预警2026-10-26 发布HIGH

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capac...

CVE-2026-115907

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications b

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-26 发布MEDIUM

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the atta...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry

来源摘录 · NVD

#cve #cwe-1284 #cwe-354

漏洞预警2026-10-26 发布INFO

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while...

CVE-2026-115905

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Centr

来源摘录 · NVD

#cve #cwe-20 #cwe-436

漏洞预警2026-10-26 发布HIGH

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha...

CVE-2026-115418

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-26 发布HIGH

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic

CVE-2026-107091

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code vi

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-26 发布HIGH

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as r...

CVE-2026-106677

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversati

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-26 发布MEDIUM

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creati...

CVE-2026-106676

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to w

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-26 发布MEDIUM

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This...

CVE-2013-10077

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/serve

来源摘录 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-26 发布LOW

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permis...

CVE-2026-93846

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-26 发布INFO

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary ...

CVE-2026-85297

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to interce

来源摘录 · NVD

#cve #cwe-340

漏洞预警2026-10-26 发布HIGH

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty ...

CVE-2026-116543

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthent

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-26 发布MEDIUM

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decod...

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthentica

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-26 发布MEDIUM

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ...

CVE-2026-116539

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BI

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-26 发布MEDIUM

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on ...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability b

来源摘录 · NVD

#cve #cwe-79