#CVE

共收录 63886 条相关情报。

漏洞预警2026-10-24 发布MEDIUM

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with e...

CVE-2026-115993

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker t

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-24 发布HIGH

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

CVE-2026-115975

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delet

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-24 发布MEDIUM

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. T...

CVE-2026-115802

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/Aut

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-24 发布MEDIUM

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When ...

CVE-2026-108013

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust cer

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-24 发布HIGH

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions...

CVE-2026-115807

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-24 发布CRITICAL

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted in...

CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-24 发布MEDIUM

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate C...

CVE-2026-115929

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root cer

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-23 发布CRITICAL

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could...

CVE-2026-115931

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not r

来源摘录 · NVD

#cve #cwe-470 #cwe-73

漏洞预警2026-10-23 发布HIGH

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allo...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is ev

来源摘录 · NVD

#cve #cwe-1336

漏洞预警2026-10-23 发布HIGH

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which C...

CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-23 发布HIGH

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place n...

CVE-2026-115935

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-23 发布HIGH

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler....

CVE-2026-115895

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-23 发布CRITICAL

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than app...

CVE-2026-115893

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 c

来源摘录 · NVD

#cve #cwe-691

漏洞预警2026-10-23 发布INFO

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-typ...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stre

来源摘录 · NVD

#cve #cwe-248 #cwe-843

漏洞预警2026-10-23 发布HIGH

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts ...

CVE-2026-115887

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-23 发布MEDIUM

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and Ge...

CVE-2026-115886

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.

来源摘录 · NVD

#cve #cwe-470 #cwe-918

漏洞预警2026-10-23 发布INFO

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard i...

CVE-2026-115885

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --ver

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-23 发布MEDIUM

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the...

CVE-2026-115801

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::

来源摘录 · NVD

#cve #cwe-119 #cwe-125

漏洞预警2026-10-23 发布LOW

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for ...

CVE-2026-83813

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.name

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-23 发布MEDIUM

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an...

CVE-2026-75525

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions

来源摘录 · NVD

#cve #cwe-863