#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-22 发布LOW

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so...

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed.

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequence...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-10-22 发布MEDIUM

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid para...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk actio

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-22 发布MEDIUM

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was c...

CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the passwo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布MEDIUM

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forw...

CVE-2026-114717

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a messa

来源摘录 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken f...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_send

来源摘录 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the ...

CVE-2026-114715

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Mo

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-su...

CVE-2026-114664

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布INFO

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, beca

历史摘要 · 未重新核验 · NVD

#cve #cwe-706

漏洞预警2026-10-22 发布HIGH

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. A...

CVE-2026-114662

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated att

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-22 发布MEDIUM

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object method...

CVE-2026-114660

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-22 发布INFO

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages pe...

CVE-2026-114659

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/p

历史摘要 · 未重新核验 · NVD

#cve #cwe-424

漏洞预警2026-10-22 发布HIGH

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attack...

CVE-2026-114658

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-22 发布CRITICAL

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matc...

CVE-2026-114656

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-22 发布INFO

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's ...

CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connect

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-22 发布LOW

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round trip...

CVE-2026-114641

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend a

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-10-22 发布INFO

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on...

CVE-2026-114640

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provi

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-22 发布HIGH

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authentic...

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthe

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布INFO

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collid...

CVE-2026-114638

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布HIGH

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connect

来源摘录 · NVD

#cve #cwe-488