#CVE

共收录 64179 条相关情报。

漏洞预警2026-10-22 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-22 发布HIGH

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candi...

CVE-2026-115513

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated u

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text...

CVE-2026-115416

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated us

来源摘录 · NVD

#cve #cwe-653 #cwe-863

漏洞预警2026-10-22 发布INFO

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.lo...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-22 发布INFO

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's ...

CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-22 发布HIGH

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS ...

CVE-2026-114605

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compres

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-22 发布INFO

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one...

CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布HIGH

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth a

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-22 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and...

CVE-2026-115453

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecomm

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-22 发布INFO

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special pri...

CVE-2026-115450

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce

来源摘录 · NVD

#cve #cwe-472

漏洞预警2026-10-22 发布MEDIUM

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, re...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function

来源摘录 · NVD

#cve #cwe-1333 #cwe-400

漏洞预警2026-10-22 发布MEDIUM

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-adminis...

CVE-2026-114487

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 20

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布MEDIUM

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass ...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allow

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user vi...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlie

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-22 发布HIGH

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in...

CVE-2026-61791

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

来源摘录 · NVD

#cve #cwe-83

漏洞预警2026-10-22 发布HIGH

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0...

CVE-2026-114510

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multip

来源摘录 · NVD

#cve #cwe-116 #cwe-943

漏洞预警2026-10-22 发布CRITICAL

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must c...

CVE-2026-94502

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentiall

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-10-22 发布HIGH

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible outp...

CVE-2026-92709

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility

来源摘录 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-22 发布CRITICAL

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using t...

CVE-2026-85080

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a

来源摘录 · NVD

#cve #cwe-121

漏洞预警2026-10-22 发布CRITICAL

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come f...

CVE-2026-85079

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially le

来源摘录 · NVD

#cve #cwe-121