#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-23 发布MEDIUM

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on t...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerab

来源摘录 · NVD

#cve #cwe-204

漏洞预警2026-10-23 发布CRITICAL

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFil...

CVE-2026-46652

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.0

来源摘录 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-10-23 发布CRITICAL

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSo...

CVE-2026-46651

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.0

来源摘录 · NVD

#cve #cwe-306 #cwe-552 #cwe-918

漏洞预警2026-10-23 发布MEDIUM

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injecti...

CVE-2026-46531

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-23 发布MEDIUM

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the applica...

CVE-2026-46347

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version

来源摘录 · NVD

#cve #cwe-330 #cwe-340 #cwe-640

漏洞预警2026-10-23 发布HIGH

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect ope...

CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_ent...

CVE-2026-115478

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `crea

来源摘录 · NVD

#cve #cwe-459 #cwe-863

漏洞预警2026-10-23 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configu...

CVE-2026-115477

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a

来源摘录 · NVD

#cve #cwe-285 #cwe-863

漏洞预警2026-10-23 发布MEDIUM

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject a...

CVE-2026-112333

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report conf

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

CVE-2026-106765

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList fun

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布HIGH

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

CVE-2026-106764

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch func

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-23 发布HIGH

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

CVE-2026-106763

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShel

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布INFO

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

CVE-2026-102786

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Galler

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet conf...

CVE-2026-93639

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no expli

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-23 发布MEDIUM

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememb...

CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthent

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through Se...

CVE-2026-93636

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwi

来源摘录 · NVD

#cve #cwe-90

漏洞预警2026-10-23 发布MEDIUM

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox thr...

CVE-2026-93634

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert f

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布MEDIUM

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled c...

CVE-2026-93633

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external ...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition al

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-23 发布MEDIUM

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms th...

CVE-2026-93630

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an una

来源摘录 · NVD

#cve #cwe-180