#CVE

共收录 56584 条相关情报。

漏洞预警2026-10-29 发布INFO

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the val...

CVE-2026-51863

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accept...

CVE-2026-51851

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:Fil

来源摘录 · NVD

#cve

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check....

CVE-2026-118769

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size con

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-125 #cwe-681 #cwe-787

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL wit...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-347

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently reje...

CVE-2026-118767

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containi

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-158

漏洞预警2026-10-29 发布MEDIUM

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Autho...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while po

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-918

漏洞预警2026-10-29 发布INFO

socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.

CVE-2026-116566

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be

来源摘录 · NVD

#cve #cwe-158

漏洞预警2026-10-29 发布HIGH

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outs...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布MEDIUM

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read p...

CVE-2026-102260

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API e

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-29 发布INFO

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, si...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and e

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-176 #cwe-754

漏洞预警2026-10-29 发布HIGH

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

CVE-2026-11587

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-89

漏洞预警2026-10-29 发布HIGH

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user ...

CVE-2026-119115

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer)

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-29 发布INFO

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the ge...

CVE-2026-118765

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-335

漏洞预警2026-10-29 发布MEDIUM

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, ...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1,

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-405 #npm #severity:medium

漏洞预警2026-10-29 发布HIGH

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that sto...

CVE-2026-118763

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/regis

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-522 #npm #severity:high

漏洞预警2026-10-29 发布CRITICAL

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write ...

CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml wo

来源摘录 · NVD

#cve #cwe-829

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives witho...

CVE-2026-118761

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-409 #go #severity:high

漏洞预警2026-10-29 发布MEDIUM

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether a...

CVE-2026-118760

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.1

来源摘录 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{nod...

CVE-2026-118759

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-200 #cwe-862 #go #severity:high

漏洞预警2026-10-29 发布HIGH

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=vo...

CVE-2026-118758

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the

来源摘录 · NVD

#cve #cwe-22