#CVE

共收录 64179 条相关情报。

漏洞预警2026-10-22 发布MEDIUM

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targ...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the applicati

来源摘录 · NVD

#cve #cwe-61

漏洞预警2026-10-22 发布MEDIUM

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This i...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-control...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthent

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-918

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw ...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWT...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBeare

来源摘录 · NVD

#cve #cwe-1188 #cwe-287

漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID ...

CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token()

来源摘录 · NVD

#cve #cwe-294 #cwe-807

漏洞预警2026-10-22 发布CRITICAL

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-lengt...

CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key()

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1391 #cwe-287 #cwe-326

漏洞预警2026-10-22 发布CRITICAL

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Auth...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() c

来源摘录 · NVD

#cve #cwe-184 #cwe-347

漏洞预警2026-10-22 发布HIGH

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

CVE-2026-111594

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmit

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-22 发布HIGH

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation s...

CVE-2026-115419

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScr

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-22 发布HIGH

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of th...

CVE-2026-115417

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 migh

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-22 发布LOW

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison ...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.securit

来源摘录 · NVD

#cve #cwe-601 #cwe-693

漏洞预警2026-10-22 发布INFO

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended ex...

CVE-2026-114583

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership che...

CVE-2026-115509

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounde...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-22 发布LOW

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and proje...

CVE-2026-115507

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/m

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too l...

CVE-2026-115506

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTol

来源摘录 · NVD

#cve #cwe-776

漏洞预警2026-10-22 发布HIGH

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or...

CVE-2026-115505

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-22 发布HIGH

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string ...

CVE-2026-115504

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-contr

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-22 发布MEDIUM

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk spac...

CVE-2026-115503

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstal

来源摘录 · NVD

#cve #cwe-409