#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-22 发布MEDIUM

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a su...

CVE-2026-115383

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts compon

来源摘录 · NVD

#cve #cwe-1287

漏洞预警2026-10-22 发布MEDIUM

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modul...

CVE-2026-115379

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves reference

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-22 发布CRITICAL

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by plan...

CVE-2026-115377

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allow

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-22 发布HIGH

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. At...

CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restr

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-22 发布CRITICAL

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems f...

CVE-2026-115375

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to crea

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients ...

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布HIGH

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operat...

CVE-2026-115372

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.cr

来源摘录 · NVD

#cve #cwe-88

漏洞预警2026-10-22 发布HIGH

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket k...

CVE-2026-115371

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability th

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-22 发布LOW

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers wi...

CVE-2026-115369

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a C

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces usin...

CVE-2026-115365

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows to

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布LOW

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanit...

CVE-2026-115363

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_

来源摘录 · NVD

#cve #cwe-212

漏洞预警2026-10-22 发布LOW

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy remov...

CVE-2026-115362

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leavi

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-22 发布MEDIUM

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attacker...

CVE-2026-115361

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden ide

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布LOW

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded cert...

CVE-2026-115359

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fail

来源摘录 · NVD

#cve #cwe-799

漏洞预警2026-10-22 发布LOW

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attack...

CVE-2026-115358

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-22 发布LOW

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when...

CVE-2026-115357

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-r

来源摘录 · NVD

#cve #cwe-778

漏洞预警2026-10-22 发布HIGH

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. ...

CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbi

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include ...

CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to re

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. ...

CVE-2026-115353

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidate...

CVE-2026-115351

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input

来源摘录 · NVD

#cve #cwe-94