#CVE

共收录 69534 条相关情报。

漏洞预警2026-10-21 发布CRITICAL

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component...

CVE-2026-113744

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewa

来源摘录 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-10-21 发布CRITICAL

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed ...

CVE-2026-114119

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布MEDIUM

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-by...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-21 发布HIGH

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts en...

CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry na...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

来源摘录 · NVD

#cve #cwe-436

漏洞预警2026-10-21 发布MEDIUM

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-21 发布HIGH

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository ...

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker ...

CVE-2026-114091

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Person...

CVE-2026-114089

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the pub...

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGI...

CVE-2026-114087

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run strea...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allow

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布INFO

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deploymen...

CVE-2026-114085

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL sh...

CVE-2026-114084

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates t

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object...

CVE-2026-114083

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via ...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allow...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-f

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalid...

CVE-2026-114080

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments becau...

CVE-2026-114079

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete...

CVE-2026-114078

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTask

历史摘要 · 未重新核验 · NVD

#cve #cwe-639