#CVE

共收录 56389 条相关情报。

漏洞预警2026-10-30 发布INFO

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remot...

CVE-2026-63393

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 u

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a vali...

CVE-2026-63378

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-30 发布CRITICAL

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api...

CVE-2026-63377

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted ver...

CVE-2026-63346

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter nam

来源摘录 · NVD

#cve #cwe-116 #cwe-94

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such...

CVE-2026-63345

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object k

来源摘录 · NVD

#cve #cwe-1116 #cwe-94

漏洞预警2026-10-30 发布INFO

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verb...

CVE-2026-63344

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the

来源摘录 · NVD

#cve #cwe-116 #cwe-94

漏洞预警2026-10-30 发布HIGH

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqe...

CVE-2026-63341

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or

来源摘录 · NVD

#cve #cwe-248 #cwe-400

漏洞预警2026-10-30 发布HIGH

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges...

CVE-2026-63339

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authentica

来源摘录 · NVD

#cve #cwe-20 #cwe-269

漏洞预警2026-10-30 发布HIGH

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to anothe...

CVE-2026-63338

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authentica

来源摘录 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-10-30 发布MEDIUM

sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination ...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z arch

来源摘录 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-10-30 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-111477

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-30 发布INFO

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribu...

CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV cr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can ...

CVE-2026-63201

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected ver

来源摘录 · NVD

#cve #cwe-134

漏洞预警2026-10-30 发布HIGH

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` ...

CVE-2026-63184

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet to

来源摘录 · NVD

#cve #cwe-829 #cwe-918

漏洞预警2026-10-30 发布HIGH

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, Light...

CVE-2026-63182

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate suppo

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布MEDIUM

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trus...

CVE-2026-63121

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions

来源摘录 · NVD

#cve #cwe-178

漏洞预警2026-10-30 发布MEDIUM

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service t...

CVE-2026-63115

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handle

来源摘录 · NVD

#cve #cwe-290 #cwe-345 #cwe-863

漏洞预警2026-10-30 发布INFO

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user ...

CVE-2026-62347

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `S

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-30 发布MEDIUM

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` ch...

CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `Print

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `ch...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases heade

来源摘录 · NVD

#cve #cwe-444