#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-20 发布INFO

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Att...

CVE-2026-109442

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-20 发布INFO

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-contai...

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-10-20 发布INFO

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web...

CVE-2026-109440

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-20 发布INFO

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and l...

CVE-2026-109395

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based Unsafe

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-20 发布INFO

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read t...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-10-20 发布INFO

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on co...

CVE-2026-105297

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set i

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-20 发布MEDIUM

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perfor...

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authe

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-20 发布INFO

A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-ba...

CVE-2026-112373

A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-10-20 发布INFO

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of h...

CVE-2026-109126

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-20 发布INFO

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

CVE-2026-107400

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary co

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-20 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, ov...

CVE-2026-107366

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authe

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege manag...

CVE-2026-105453

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-19 发布MEDIUM

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when t...

CVE-2026-77684

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT comma

来源摘录 · NVD

#cve #cwe-401

漏洞预警2026-10-19 发布MEDIUM

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_...

CVE-2026-19595

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two out

来源摘录 · NVD

#cve #cwe-787 #cwe-822

漏洞预警2026-10-19 发布INFO

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

CVE-2026-19178

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-19 发布INFO

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGE...

CVE-2026-112991

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-10-19 发布INFO

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes pat...

CVE-2026-112372

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/uplo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-19 发布INFO

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of t...

CVE-2026-112371

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-10-19 发布INFO

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command inj...

CVE-2026-112370

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usr

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-19 发布INFO

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to imper...

CVE-2025-36252

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate

历史摘要 · 未重新核验 · NVD

#cve #cwe-613