#CVE

共收录 69535 条相关情报。

漏洞预警2026-10-20 发布INFO

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is r...

CVE-2026-94018

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` under

历史摘要 · 未重新核验 · NVD

#cve #cwe-457 #cwe-824

漏洞预警2026-10-20 发布INFO

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_...

CVE-2026-93475

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts in

历史摘要 · 未重新核验 · NVD

#cve #cwe-787 #cwe-1284

漏洞预警2026-10-20 发布INFO

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request...

CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-10-20 发布INFO

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero...

CVE-2026-92853

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-191

漏洞预警2026-10-20 发布INFO

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-o...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The ov...

CVE-2026-91057

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator databas...

CVE-2026-90800

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. User...

CVE-2026-90799

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-20 发布INFO

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service vi...

CVE-2026-90798

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-834

漏洞预警2026-10-20 发布INFO

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion....

CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote c

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-20 发布INFO

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operat...

CVE-2026-86471

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-20 发布INFO

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py ...

CVE-2026-113703

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where en

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-20 发布INFO

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filenam...

CVE-2026-113683

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegat...

CVE-2026-113682

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-20 发布INFO

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causi...

CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineo

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-10-20 发布INFO

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and fo...

CVE-2026-113680

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly sha

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-20 发布INFO

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signa...

CVE-2026-113679

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-20 发布INFO

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host dir...

CVE-2026-113678

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-20 发布INFO

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-prov...

CVE-2026-113677

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier conf...

CVE-2026-113676

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863