Cyber Security Daily Radar

#cwe-20

共收录 1721 条相关情报。

← 返回所有主题
漏洞预警2026-10-06 发布INFO

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary co...

CVE-2026-106414

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveragi

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy vi...

CVE-2026-106396

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker lev

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a c...

CVE-2026-106353

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveragi

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privil...

CVE-2026-106331

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging soc

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrict...

CVE-2026-106299

Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromi

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a cr...

CVE-2026-106263

Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a cr...

CVE-2026-106226

Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compr

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chr...

CVE-2026-106206

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtai

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions ...

CVE-2026-106185

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised t

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L Chi...

CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command I

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-10-06 发布INFO

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processin...

CVE-2026-56596

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
安全公告2026-10-05 发布INFO

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

CVE-2026-96747

### Summary PyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, which returns any string ending

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-20#cwe-918#severity:medium
安全公告2026-10-05 发布INFO

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

CVE-2026-102600

### Impact This is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`. Se

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-20#severity:high
安全公告2026-10-05 发布INFO

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

CVE-2026-105754

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-20#cwe-617#cwe-639#cwe-668
安全公告2026-10-05 发布INFO

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

CVE-2026-105757

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-20#cwe-248#cwe-755#severity:medium
安全公告2026-10-05 发布INFO

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

CVE-2026-105756

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-20#cwe-248#severity:medium
漏洞预警2026-10-05 发布INFO

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineC...

CVE-2026-105757

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures c

历史摘要 · 未重新核验 · NVD

#cve#cwe-20#cwe-248#cwe-755
漏洞预警2026-10-05 发布INFO

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the ch...

CVE-2026-105756

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models acc

历史摘要 · 未重新核验 · NVD

#cve#cwe-20#cwe-248
漏洞预警2026-10-05 发布INFO

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-suppli...

CVE-2026-105754

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint

历史摘要 · 未重新核验 · NVD

#cve#cwe-20#cwe-617#cwe-639#cwe-668#cwe-704
漏洞预警2026-10-05 发布INFO

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial...

CVE-2026-58834

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to i

历史摘要 · 未重新核验 · NVD

#cve#cwe-20