#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-25 发布MEDIUM

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the ...

CVE-2026-116057

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown function

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-25 发布MEDIUM

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of...

CVE-2026-116055

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-25 发布LOW

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password h...

CVE-2026-116054

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Mó

来源摘录 · NVD

#cve #cwe-326 #cwe-916

漏洞预警2026-10-25 发布HIGH

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unesc...

CVE-2026-116211

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche fiel

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-25 发布HIGH

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other act...

CVE-2026-116208

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts tha

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-25 发布MEDIUM

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTM...

CVE-2026-116206

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-25 发布MEDIUM

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax...

CVE-2026-116205

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布HIGH

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or r...

CVE-2026-116204

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/de

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-25 发布MEDIUM

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageFi...

CVE-2026-116202

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-25 发布HIGH

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs ha...

CVE-2026-116201

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions

来源摘录 · NVD

#cve #cwe-294

漏洞预警2026-10-25 发布MEDIUM

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the Star...

CVE-2026-116200

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-25 发布MEDIUM

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers l...

CVE-2026-116198

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext i

来源摘录 · NVD

#cve #cwe-311

漏洞预警2026-10-25 发布LOW

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concr...

CVE-2026-116197

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller

来源摘录 · NVD

#cve #cwe-1289

漏洞预警2026-10-25 发布MEDIUM

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-d...

CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authori

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-25 发布MEDIUM

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts ...

CVE-2026-116194

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost O

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-25 发布MEDIUM

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS reque...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticat

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-25 发布MEDIUM

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by sup...

CVE-2026-116192

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布LOW

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to differen...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-25 发布HIGH

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums fro

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-25 发布MEDIUM

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attacke...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory acco

来源摘录 · NVD

#cve #cwe-190