#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-22 发布INFO

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only lo...

CVE-2026-93336

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-auth

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布MEDIUM

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Che...

CVE-2026-77157

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.c

来源摘录 · NVD

#cve #cwe-353

漏洞预警2026-10-22 发布MEDIUM

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Re...

CVE-2026-77156

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when i

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft....

CVE-2026-54532

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workfl

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-22 发布LOW

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp cl...

CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-22 发布CRITICAL

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment en...

CVE-2026-114611

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-22 发布MEDIUM

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose defaul...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG re

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-22 发布MEDIUM

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied ...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attac

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-22 发布HIGH

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement...

CVE-2026-113874

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted s

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain se...

CVE-2026-113873

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compres

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-22 发布MEDIUM

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the...

CVE-2026-108360

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-863 #cwe-918

漏洞预警2026-10-22 发布INFO

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Re...

CVE-2026-108359

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-22 发布INFO

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Success...

CVE-2026-97631

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorr

来源摘录 · NVD

#cve #cwe-120 #cwe-131 #cwe-787

漏洞预警2026-10-22 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-22 发布HIGH

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candi...

CVE-2026-115513

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated u

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text...

CVE-2026-115416

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated us

来源摘录 · NVD

#cve #cwe-653 #cwe-863

漏洞预警2026-10-22 发布INFO

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.lo...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-22 发布INFO

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's ...

CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-22 发布HIGH

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS ...

CVE-2026-114605

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compres

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-22 发布INFO

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one...

CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req

来源摘录 · NVD

#cve #cwe-770