#CVE

共收录 56584 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unva...

CVE-2026-119599

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-le

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-30 发布MEDIUM

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' confi...

CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs t

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布CRITICAL

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:S...

CVE-2026-119597

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-30 发布MEDIUM

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. ...

CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authentic

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory'...

CVE-2026-119578

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows a

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-p...

CVE-2026-119577

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access thro

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only...

CVE-2026-119576

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readReco

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP b...

CVE-2026-119575

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-30 发布MEDIUM

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrade...

CVE-2026-119574

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-567

漏洞预警2026-10-30 发布MEDIUM

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation whe...

CVE-2026-119573

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cr

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布HIGH

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the aut...

CVE-2026-119572

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX pr

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-30 发布LOW

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-...

CVE-2026-119571

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates address

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布LOW

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave trigge...

CVE-2026-119570

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to re

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-30 发布MEDIUM

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-prope...

CVE-2026-119569

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-co

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an u...

CVE-2026-119542

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursiv

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布HIGH

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Ope...

CVE-2026-119528

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only whe...

CVE-2026-118987

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cook

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two cal...

CVE-2026-118986

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). Th

来源摘录 · NVD

#cve #cwe-338

漏洞预警2026-10-30 发布INFO

Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.

CVE-2026-117350

Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate ...

CVE-2026-117028

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::che

来源摘录 · NVD

#cve