#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-19 发布INFO

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extract...

CVE-2026-112302

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-19 发布INFO

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation o...

CVE-2026-112301

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Comm

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-19 发布INFO

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/init.py. The manipulation...

CVE-2026-112300

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionm

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-10-19 发布INFO

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditPro...

CVE-2026-112299

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-19 发布MEDIUM

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag...

CVE-2026-111946

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.

来源摘录 · NVD

#cve #cwe-497

漏洞预警2026-10-19 发布INFO

Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit t...

CVE-2026-71170

Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileg

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-10-19 发布INFO

Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access ...

CVE-2026-71169

Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-19 发布INFO

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit ...

CVE-2026-112782

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymo

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-19 发布INFO

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page fro...

CVE-2026-112781

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-19 发布INFO

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translati...

CVE-2026-112779

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed langua

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-19 发布INFO

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class reso...

CVE-2026-112777

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-10-19 发布INFO

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSit...

CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-19 发布INFO

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string fie...

CVE-2026-112774

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrato

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-19 发布INFO

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType...

CVE-2026-112772

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Pane

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-19 发布INFO

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters r...

CVE-2026-112771

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, conta

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-19 发布INFO

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An auth...

CVE-2026-112769

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-19 发布HIGH

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causi...

CVE-2026-112260

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-19 发布MEDIUM

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of s...

CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer deref

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-19 发布INFO

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshel...

CVE-2026-112252

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Informat

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-19 发布HIGH

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a ...

CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer pe

来源摘录 · NVD

#cve #cwe-407