#CVE

共收录 56389 条相关情报。

漏洞预警2026-10-30 发布INFO

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arriv...

CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HT

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布LOW

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX...

CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an in

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布MEDIUM

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 2...

CVE-2026-55147

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 1...

CVE-2026-55146

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-693 #severity:high

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted qualname (for example "Values.read_file") is resolved by pickle's find_class throug...

CVE-2026-118938

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-706 #severity:high

漏洞预警2026-10-30 发布HIGH

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billi...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-30 发布MEDIUM

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php...

CVE-2026-62991

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show`

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a conte...

CVE-2026-62990

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1

来源摘录 · NVD

#cve #cwe-269 #cwe-79

漏洞预警2026-10-30 发布HIGH

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `De...

CVE-2026-62989

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Li

来源摘录 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-10-30 发布INFO

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP...

CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handl

来源摘录 · NVD

#cve #cwe-200 #cwe-209

漏洞预警2026-10-30 发布INFO

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specifi...

CVE-2026-62968

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input

来源摘录 · NVD

#cve #cwe-88

漏洞预警2026-10-30 发布HIGH

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate anoth...

CVE-2026-62967

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenti

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布HIGH

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cp...

CVE-2026-62966

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to v

来源摘录 · NVD

#cve #cwe-476 #cwe-672

漏洞预警2026-10-30 发布INFO

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without pa...

CVE-2026-62965

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py`

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布HIGH

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` pr...

CVE-2026-62958

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host

来源摘录 · NVD

#cve #cwe-125 #cwe-20

漏洞预警2026-10-30 发布HIGH

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses...

CVE-2026-62864

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-para

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布CRITICAL

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate ...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its

来源摘录 · NVD

#cve #cwe-306 #cwe-942

漏洞预警2026-10-30 发布MEDIUM

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discr...

CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint

来源摘录 · NVD

#cve #cwe-208

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandb...

CVE-2026-62853

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-s

来源摘录 · NVD

#cve #cwe-78 #cwe-94