#CVE

共收录 70309 条相关情报。

漏洞预警2026-10-20 发布MEDIUM

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attac...

CVE-2024-2323

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history vali

来源摘录 · NVD

#cve #cwe-307

漏洞预警2026-10-20 发布INFO

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insuffi...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious se...

CVE-2026-113404

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-20 发布INFO

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, th...

CVE-2026-113403

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-10-20 发布INFO

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to...

CVE-2026-113402

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-10-20 发布INFO

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScr...

CVE-2026-112148

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(),...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-41 #cwe-116

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-172 #cwe-180

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for H...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-436

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() a...

CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-41

漏洞预警2026-10-20 发布INFO

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator pr...

CVE-2026-97627

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use

历史摘要 · 未重新核验 · NVD

#cve #cwe-912

漏洞预警2026-10-20 发布INFO

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticate...

CVE-2026-96903

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contac

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read de...

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public R

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-20 发布INFO

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient es...

CVE-2026-93300

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-20 发布INFO

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator pr...

CVE-2026-100737

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use

历史摘要 · 未重新核验 · NVD

#cve #cwe-912

漏洞预警2026-10-20 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into ...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-10-20 发布INFO

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and p...

CVE-2026-113380

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-20 发布INFO

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.

CVE-2026-109831

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may le

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-20 发布HIGH

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the Aut...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-20 发布MEDIUM

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to esca...

CVE-2026-12489

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.4

来源摘录 · NVD

#cve #cwe-863