#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-21 发布HIGH

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized ...

CVE-2026-29001

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to ach

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-502

漏洞预警2026-10-21 发布MEDIUM

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signe...

CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-21 发布MEDIUM

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argumen...

CVE-2026-114380

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布INFO

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controll...

CVE-2026-114379

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImage

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布INFO

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID re...

CVE-2026-114378

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布LOW

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go...

CVE-2026-114377

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodul...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-10-21 发布HIGH

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js ...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dot...

CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in ...

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPath...

CVE-2026-114141

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-21 发布INFO

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/p...

CVE-2026-114140

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application mid...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the web

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-21 发布HIGH

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in

来源摘录 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-21 发布INFO

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while t...

CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framewor

历史摘要 · 未重新核验 · NVD

#cve #cwe-390 #cwe-613

漏洞预警2026-10-21 发布HIGH

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for ea...

CVE-2026-113811

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure s

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布MEDIUM

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traver...

CVE-2026-85518

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validat

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action i...

CVE-2026-114438

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-21 发布INFO

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/edi...

CVE-2026-114376

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function Sa

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Fi...

CVE-2026-114375

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler o

历史摘要 · 未重新核验 · NVD

#cve #cwe-22