#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-22 发布MEDIUM

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied ...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attac

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-22 发布HIGH

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement...

CVE-2026-113874

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted s

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain se...

CVE-2026-113873

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compres

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-22 发布MEDIUM

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the...

CVE-2026-108360

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-863 #cwe-918

漏洞预警2026-10-22 发布INFO

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Re...

CVE-2026-108359

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-10-22 发布INFO

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Success...

CVE-2026-97631

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorr

来源摘录 · NVD

#cve #cwe-120 #cwe-131 #cwe-787

漏洞预警2026-10-22 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-22 发布HIGH

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candi...

CVE-2026-115513

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated u

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text...

CVE-2026-115416

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated us

来源摘录 · NVD

#cve #cwe-653 #cwe-863

漏洞预警2026-10-22 发布INFO

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.lo...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-22 发布INFO

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's ...

CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-22 发布HIGH

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS ...

CVE-2026-114605

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compres

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-22 发布INFO

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one...

CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布HIGH

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth a

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-22 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and...

CVE-2026-115453

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecomm

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-22 发布INFO

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special pri...

CVE-2026-115450

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce

来源摘录 · NVD

#cve #cwe-472

漏洞预警2026-10-22 发布MEDIUM

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, re...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function

来源摘录 · NVD

#cve #cwe-1333 #cwe-400

漏洞预警2026-10-22 发布MEDIUM

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-adminis...

CVE-2026-114487

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 20

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布MEDIUM

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass ...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allow

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布MEDIUM

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user vi...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlie

来源摘录 · NVD

#cve #cwe-201