#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-12 发布INFO

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Atta...

CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origin

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetIn...

CVE-2026-109558

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders te

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles....

CVE-2026-109557

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-suppl...

CVE-2026-109556

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC hand

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging un...

CVE-2026-109427

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated toke

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-12 发布INFO

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's a...

CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the Mongo

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-10-12 发布INFO

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attack...

CVE-2026-109380

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entr

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-10-12 发布INFO

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/c...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enum

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-10-12 发布INFO

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating target...

CVE-2026-109378

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-12 发布INFO

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, i...

CVE-2026-109377

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. ...

CVE-2026-109376

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by plantin...

CVE-2026-109375

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows san

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-12 发布INFO

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the ...

CVE-2026-108931

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cg

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Hand...

CVE-2026-108930

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-12 发布INFO

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of...

CVE-2026-108929

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSs

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-88

漏洞预警2026-10-12 发布INFO

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation ...

CVE-2026-108928

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-12 发布INFO

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of ...

CVE-2026-108927

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unk

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-12 发布INFO

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action ...

CVE-2026-106495

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re...

CVE-2026-105052

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder p...

CVE-2025-71429

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-78