#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-13 发布INFO

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an auth...

CVE-2026-103965

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during in

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-13 发布INFO

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data so...

CVE-2026-103928

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-13 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoi...

CVE-2026-102988

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-13 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a craf...

CVE-2026-102982

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/...

CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

漏洞预警2026-10-13 发布INFO

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownvi...

CVE-2026-102832

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-863

漏洞预警2026-10-13 发布INFO

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes t...

CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-749 #cwe-913

漏洞预警2026-10-13 发布INFO

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues wi...

CVE-2026-102702

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that c...

CVE-2026-102700

With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues wi...

CVE-2026-102699

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on ma...

CVE-2026-102672

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-10-13 发布INFO

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix in...

CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy trea

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-13 发布INFO

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler....

CVE-2024-34326

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId coo...

CVE-2024-34324

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a c

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers ...

CVE-2024-34323

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-13 发布INFO

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

CVE-2024-34321

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoin

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has t...

CVE-2026-9218

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-13 发布INFO

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Up...

CVE-2026-97334

The network messaging layer contained improper handling of highly compressed data affecting service availability. Softw

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-13 发布INFO

QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command C...

CVE-2026-97333

QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved mai

历史摘要 · 未重新核验 · NVD

#cve #cwe-121