#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-12 发布INFO

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSa...

CVE-2026-109344

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutral

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticat...

CVE-2026-109343

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespac

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate ot...

CVE-2026-109342

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows l

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Pa...

CVE-2026-109341

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DEL...

CVE-2026-109340

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to dele

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured mod...

CVE-2026-109339

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffer

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. ...

CVE-2026-109338

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT W...

CVE-2026-109337

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hid

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projec...

CVE-2026-109336

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPU...

CVE-2026-109335

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read valu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cro...

CVE-2026-109334

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace-

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resol...

CVE-2026-109333

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-12 发布INFO

Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Acc...

CVE-2026-109332

Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-12 发布INFO

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first...

CVE-2026-109331

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse

历史摘要 · 未重新核验 · NVD

#cve #cwe-436

漏洞预警2026-10-12 发布INFO

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handle...

CVE-2026-109330

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows re

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

漏洞预警2026-10-12 发布INFO

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizatio...

CVE-2026-109329

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration val...

CVE-2026-109328

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresent

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inj...

CVE-2026-109327

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthentic...

CVE-2026-109326

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 con

历史摘要 · 未重新核验 · NVD

#cve #cwe-527

漏洞预警2026-10-12 发布INFO

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind...

CVE-2026-109325

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loop

历史摘要 · 未重新核验 · NVD

#cve #cwe-200