#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken f...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_send

来源摘录 · NVD

#cve #cwe-99

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the ...

CVE-2026-114715

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Mo

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布HIGH

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-su...

CVE-2026-114664

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布INFO

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, beca

历史摘要 · 未重新核验 · NVD

#cve #cwe-706

漏洞预警2026-10-22 发布HIGH

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. A...

CVE-2026-114662

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated att

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-22 发布MEDIUM

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object method...

CVE-2026-114660

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that

来源摘录 · NVD

#cve #cwe-470

漏洞预警2026-10-22 发布INFO

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages pe...

CVE-2026-114659

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/p

历史摘要 · 未重新核验 · NVD

#cve #cwe-424

漏洞预警2026-10-22 发布HIGH

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attack...

CVE-2026-114658

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-22 发布CRITICAL

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matc...

CVE-2026-114656

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-22 发布INFO

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's ...

CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connect

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-22 发布LOW

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round trip...

CVE-2026-114641

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend a

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-10-22 发布INFO

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on...

CVE-2026-114640

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provi

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-22 发布HIGH

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authentic...

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthe

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布INFO

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collid...

CVE-2026-114638

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-22 发布HIGH

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connect

来源摘录 · NVD

#cve #cwe-488

漏洞预警2026-10-22 发布INFO

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-T...

CVE-2026-114636

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTT

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-22 发布HIGH

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can...

CVE-2026-114635

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped w

来源摘录 · NVD

#cve #cwe-288

漏洞预警2026-10-22 发布INFO

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validati...

CVE-2026-114634

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() be

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-22 发布MEDIUM

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can ...

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts t

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-22 发布INFO

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The man...

CVE-2026-114577

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89