#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owne...

CVE-2026-114394

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content at

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and P...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify ticke

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attacker...

CVE-2026-114392

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets ou

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to mo...

CVE-2026-114388

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in Gr

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by th...

CVE-2026-114243

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布HIGH

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service ...

CVE-2026-81755

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attac

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布HIGH

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server ...

CVE-2026-80463

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms a

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams ...

CVE-2026-79704

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0)

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布CRITICAL

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or delive...

CVE-2026-78334

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote atta

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布HIGH

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or ...

CVE-2026-78066

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled inp

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server...

CVE-2026-78058

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms all

来源摘录 · NVD

#cve #cwe-400 #cwe-476

漏洞预警2026-10-21 发布HIGH

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to c...

CVE-2026-78048

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-21 发布HIGH

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control m...

CVE-2026-74758

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to cras

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-21 发布HIGH

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing...

CVE-2026-74755

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attacke

来源摘录 · NVD

#cve #cwe-191

漏洞预警2026-10-21 发布MEDIUM

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or...

CVE-2026-66392

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, b

来源摘录 · NVD

#cve #cwe-297

漏洞预警2026-10-21 发布HIGH

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote...

CVE-2026-61916

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布HIGH

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase resp...

CVE-2026-61902

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTT

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布CRITICAL

Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to ...

CVE-2026-59562

Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布HIGH

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SY...

CVE-2026-59229

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布HIGH

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was ava...

CVE-2026-58064

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection

来源摘录 · NVD

#cve #cwe-770