#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-12 发布INFO

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next qu...

CVE-2024-58389

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-12 发布MEDIUM

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure ...

CVE-2022-51020

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-12 发布INFO

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prot...

CVE-2021-48012

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-10-12 发布INFO

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. At...

CVE-2021-48011

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escap

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map l

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-12 发布INFO

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, ...

CVE-2020-37279

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute comma

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization an...

CVE-2026-96012

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-264

漏洞预警2026-10-12 发布INFO

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque ...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack han

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-10-12 发布INFO

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process...

CVE-2026-95837

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer check

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-12 发布INFO

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal...

CVE-2026-41510

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza sil

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-770

漏洞预警2026-10-12 发布INFO

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drop...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate...

CVE-2026-109425

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecre

历史摘要 · 未重新核验 · NVD

#cve #cwe-1286

漏洞预警2026-10-12 发布INFO

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies a...

CVE-2026-109424

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-10-12 发布INFO

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent atta...

CVE-2026-109423

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate val

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-12 发布INFO

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.na...

CVE-2026-109422

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code executi

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the arg...

CVE-2026-108926

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown p

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-12 发布INFO

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the c...

CVE-2026-108924

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery:

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-10-12 发布INFO

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the com...

CVE-2026-108923

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-10-12 发布INFO

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested ...

CVE-2026-108362

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-12 发布INFO

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify worklo...

CVE-2026-108361

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before

历史摘要 · 未重新核验 · NVD

#cve #cwe-367