#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-13 发布INFO

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_pattern...

CVE-2026-103028

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy p

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accept...

CVE-2026-102603

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the pass

历史摘要 · 未重新核验 · NVD

#cve #cwe-620

漏洞预警2026-10-13 发布INFO

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an anim...

CVE-2026-102342

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-13 发布INFO

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware up...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be up

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-13 发布INFO

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS a...

CVE-2024-34319

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-13 发布INFO

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVE-2026-95680

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to a

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-13 发布INFO

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-93907

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a fla

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated ...

CVE-2026-93347

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent request...

CVE-2026-93346

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (AC...

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path...

CVE-2026-77361

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment ...

CVE-2026-74047

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent ca...

CVE-2026-74045

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from inp

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to wr...

CVE-2026-74043

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-13 发布INFO

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated us...

CVE-2026-74041

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-10-13 发布INFO

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite prote...

CVE-2026-74040

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-13 发布INFO

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked adm...

CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-13 发布INFO

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers contr...

CVE-2026-74036

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a fal...

CVE-2026-74035

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_pat...

CVE-2026-74034

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-862