#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-23 发布HIGH

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect ope...

CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_ent...

CVE-2026-115478

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `crea

来源摘录 · NVD

#cve #cwe-459 #cwe-863

漏洞预警2026-10-23 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configu...

CVE-2026-115477

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a

来源摘录 · NVD

#cve #cwe-285 #cwe-863

漏洞预警2026-10-23 发布MEDIUM

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject a...

CVE-2026-112333

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report conf

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

CVE-2026-106765

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList fun

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布HIGH

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

CVE-2026-106764

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch func

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-23 发布HIGH

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

CVE-2026-106763

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShel

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布INFO

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

CVE-2026-102786

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Galler

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet conf...

CVE-2026-93639

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no expli

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-23 发布MEDIUM

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememb...

CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthent

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through Se...

CVE-2026-93636

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwi

来源摘录 · NVD

#cve #cwe-90

漏洞预警2026-10-23 发布MEDIUM

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox thr...

CVE-2026-93634

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert f

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布MEDIUM

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled c...

CVE-2026-93633

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external ...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition al

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-23 发布MEDIUM

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms th...

CVE-2026-93630

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an una

来源摘录 · NVD

#cve #cwe-180

漏洞预警2026-10-23 发布MEDIUM

An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. T...

CVE-2026-93629

An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-23 发布MEDIUM

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's respon...

CVE-2026-93628

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-23 发布MEDIUM

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing m...

CVE-2026-93627

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an

来源摘录 · NVD

#cve #cwe-290

漏洞预警2026-10-23 发布MEDIUM

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication ...

CVE-2026-57207

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running w

来源摘录 · NVD

#cve #cwe-1059 #cwe-306

漏洞预警2026-10-23 发布INFO

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event trackin...

CVE-2026-55826

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to befo

来源摘录 · NVD

#cve #cwe-200