#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-26 发布MEDIUM

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creati...

CVE-2026-106676

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to w

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-26 发布MEDIUM

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This...

CVE-2013-10077

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/serve

来源摘录 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-26 发布LOW

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permis...

CVE-2026-93846

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-26 发布INFO

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary ...

CVE-2026-85297

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to interce

来源摘录 · NVD

#cve #cwe-340

漏洞预警2026-10-26 发布HIGH

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty ...

CVE-2026-116543

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthent

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-26 发布MEDIUM

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decod...

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthentica

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-26 发布MEDIUM

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ...

CVE-2026-116539

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BI

来源摘录 · NVD

#cve #cwe-787

漏洞预警2026-10-26 发布MEDIUM

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on ...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability b

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-26 发布HIGH

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or o...

CVE-2026-116489

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users t

来源摘录 · NVD

#cve #cwe-843

漏洞预警2026-10-26 发布MEDIUM

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Suc...

CVE-2026-116369

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleL

来源摘录 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-26 发布MEDIUM

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sand...

CVE-2026-116367

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of

来源摘录 · NVD

#cve #cwe-264 #cwe-265

漏洞预警2026-10-26 发布HIGH

UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) imp...

CVE-2026-115748

**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-26 发布HIGH

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of...

CVE-2026-115721

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-26 发布CRITICAL

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the s...

CVE-2026-112346

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the Doc

来源摘录 · NVD

#cve #cwe-1327

漏洞预警2026-10-26 发布MEDIUM

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outsid...

CVE-2026-112344

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-26 发布HIGH

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-ins...

CVE-2026-112343

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to e

来源摘录 · NVD

#cve #cwe-41

漏洞预警2026-10-26 发布HIGH

An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution ...

CVE-2026-107090

An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code

来源摘录 · NVD

#cve #cwe-427

漏洞预警2026-10-26 发布MEDIUM

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. T...

CVE-2026-107080

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dw

来源摘录 · NVD

#cve #cwe-125 #cwe-787

漏洞预警2026-10-26 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The processor may fail to invalidate a TLB entry while executing an...

CVE-2026-99099

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The proces

来源摘录 · NVD

#cve

漏洞预警2026-10-26 发布INFO

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted...

CVE-2026-99095

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D

来源摘录 · NVD

#cve