#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-12 发布INFO

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addres...

CVE-2026-109364

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-10-12 发布INFO

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re...

CVE-2026-109363

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-12 发布INFO

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execu...

CVE-2026-109362

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep exec

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-12 发布INFO

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json wi...

CVE-2026-109361

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postpro

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over pla...

CVE-2026-109360

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-12 发布INFO

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generatio...

CVE-2026-109359

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-12 发布INFO

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local ...

CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer w

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and a...

CVE-2026-109357

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because userna

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privilege...

CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers c...

CVE-2026-109355

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Ox

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ seq...

CVE-2026-109354

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notificatio...

CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-12 发布INFO

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, pop...

CVE-2026-109352

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.p

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-12 发布INFO

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq...

CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header d

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-10-12 发布INFO

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attack...

CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-12 发布INFO

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements ...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATT

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-12 发布INFO

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_i...

CVE-2026-109346

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-10-12 发布INFO

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element wh...

CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-79