#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-21 发布MEDIUM

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose par...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional

来源摘录 · NVD

#cve #cwe-807

漏洞预警2026-10-21 发布LOW

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone who...

CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an addi

来源摘录 · NVD

#cve #cwe-354

漏洞预警2026-10-21 发布LOW

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the proc...

CVE-2026-114236

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file

来源摘录 · NVD

#cve #cwe-772

漏洞预警2026-10-21 发布MEDIUM

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a defaul...

CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'u

来源摘录 · NVD

#cve #cwe-205

漏洞预警2026-10-21 发布INFO

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path...

CVE-2026-82819

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manip

来源摘录 · NVD

#cve #cwe-40

漏洞预警2026-10-21 发布MEDIUM

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number ...

CVE-2026-92824

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布MEDIUM

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative ...

CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-21 发布MEDIUM

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without...

CVE-2026-92822

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values th

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-21 发布CRITICAL

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component...

CVE-2026-113744

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewa

来源摘录 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-10-21 发布CRITICAL

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed ...

CVE-2026-114119

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布MEDIUM

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-by...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-21 发布HIGH

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts en...

CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry na...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-21 发布MEDIUM

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-21 发布HIGH

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository ...

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker ...

CVE-2026-114091

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Person...

CVE-2026-114089

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the pub...

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGI...

CVE-2026-114087

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run strea...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allow

来源摘录 · NVD

#cve #cwe-306