#CVE

共收录 57338 条相关情报。

← 返回所有主题

漏洞预警2026-10-30 发布INFO

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the resu...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-626

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer o...

CVE-2026-116128

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked re

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not...

CVE-2026-116127

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persi

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding c

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysre...

CVE-2026-115865

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting me

来源摘录 · NVD

#cve #cwe-789

漏洞预警2026-10-30 发布MEDIUM

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to forc...

CVE-2026-112374

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /ap

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privil...

CVE-2026-111503

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potential...

CVE-2026-111502

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A l

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjace...

CVE-2026-111501

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attemp

来源摘录 · NVD

#cve #cwe-307

漏洞预警2026-10-30 发布MEDIUM

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row V...

CVE-2026-119591

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to cra

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-30 发布HIGH

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql ...

CVE-2026-119586

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits a

来源摘录 · NVD

#cve #cwe-77

漏洞预警2026-10-30 发布HIGH

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their...

CVE-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated at

来源摘录 · NVD

#cve #cwe-940

漏洞预警2026-10-30 发布LOW

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cm...

CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute deni

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-30 发布MEDIUM

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to ...

CVE-2026-119566

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google I

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications...

CVE-2026-119565

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that al

来源摘录 · NVD

#cve #cwe-915

漏洞预警2026-10-30 发布MEDIUM

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer I...

CVE-2026-119564

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site edit

来源摘录 · NVD

#cve #cwe-201

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in Desi...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE pri

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /data...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supply

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures a...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionRespo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布MEDIUM

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge a...

CVE-2026-119560

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append

来源摘录 · NVD

#cve #cwe-93