#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-22 发布CRITICAL

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Auth...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() c

来源摘录 · NVD

#cve #cwe-184 #cwe-347

漏洞预警2026-10-22 发布HIGH

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

CVE-2026-111594

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmit

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-22 发布HIGH

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation s...

CVE-2026-115419

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScr

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-22 发布HIGH

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of th...

CVE-2026-115417

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 migh

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-22 发布LOW

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison ...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.securit

来源摘录 · NVD

#cve #cwe-601 #cwe-693

漏洞预警2026-10-22 发布INFO

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended ex...

CVE-2026-114583

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership che...

CVE-2026-115509

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounde...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-22 发布LOW

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and proje...

CVE-2026-115507

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/m

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too l...

CVE-2026-115506

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTol

来源摘录 · NVD

#cve #cwe-776

漏洞预警2026-10-22 发布HIGH

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or...

CVE-2026-115505

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-22 发布HIGH

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string ...

CVE-2026-115504

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-contr

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-22 发布MEDIUM

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk spac...

CVE-2026-115503

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstal

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-22 发布MEDIUM

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive en...

CVE-2026-115398

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileS

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布HIGH

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topi...

CVE-2026-112332

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a re

来源摘录 · NVD

#cve #cwe-755

漏洞预警2026-10-22 发布HIGH

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by ...

CVE-2026-112331

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records

来源摘录 · NVD

#cve #cwe-755

漏洞预警2026-10-22 发布HIGH

An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the avai...

CVE-2026-79886

An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could all

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-22 发布HIGH

An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifica...

CVE-2026-79885

An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布HIGH

A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive i...

CVE-2026-79884

A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypas

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布HIGH

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploi...

CVE-2026-79883

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent at

来源摘录 · NVD

#cve #cwe-120