#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-21 发布MEDIUM

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attack...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG conten

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-10-21 发布MEDIUM

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the compon...

CVE-2026-114265

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布HIGH

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController...

CVE-2026-114262

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the funct

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-21 发布INFO

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRo...

CVE-2026-114176

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response ...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer seriali

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys ca...

CVE-2026-114132

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by d

历史摘要 · 未重新核验 · NVD

#cve #cwe-178 #cwe-863

漏洞预警2026-10-21 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution d...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rul

来源摘录 · NVD

#cve #cwe-436 #cwe-863

漏洞预警2026-10-21 发布INFO

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-ca...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布MEDIUM

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regu...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-21 发布INFO

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML ...

CVE-2026-114128

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within ...

CVE-2026-114127

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS ge

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook develo...

CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94 #cwe-306

漏洞预警2026-10-21 发布INFO

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website ...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19,

来源摘录 · NVD

#cve #cwe-1021 #cwe-346 #cwe-94

漏洞预警2026-10-21 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data...

CVE-2026-114124

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: fro...

CVE-2026-112868

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured A

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected insta...

CVE-2026-111184

NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-21 发布INFO

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati...

CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-21 发布INFO

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide im...

CVE-2026-110744

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-21 发布INFO

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying...

CVE-2026-105930

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopi...

CVE-2026-105927

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query paramete

来源摘录 · NVD

#cve #cwe-863