#cwe-829

共收录 170 条相关情报。

← 返回所有主题
漏洞预警2026-10-30 发布HIGH

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` ...

CVE-2026-63184

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet to

来源摘录 · NVD

漏洞预警2026-10-29 发布CRITICAL

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write ...

CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml wo

来源摘录 · NVD

漏洞预警2026-10-29 发布INFO

A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 ...

CVE-2023-7357

A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vul

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct...

CVE-2026-15564

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions i...

CVE-2026-114488

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security i

来源摘录 · NVD

漏洞预警2026-10-28 发布HIGH

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to...

CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmars

来源摘录 · NVD

漏洞预警2026-10-28 发布HIGH

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `versi...

CVE-2026-59176

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool

来源摘录 · NVD / OSV.dev

漏洞预警2026-10-28 发布HIGH

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` director...

CVE-2026-59172

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint ` walks upward f

来源摘录 · NVD / OSV.dev

漏洞预警2026-10-27 发布INFO

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted...

CVE-2026-65119

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker

历史摘要 · 未重新核验 · NVD

安全公告2026-10-27 发布INFO

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to...

CVE-2026-116843

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defini

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-27 发布INFO

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/c...

CVE-2026-116843

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defini

历史摘要 · 未重新核验 · NVD

安全公告2026-10-24 发布INFO

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function...

CVE-2026-115802

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/Aut

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-24 发布MEDIUM

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. T...

CVE-2026-115802

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/Aut

来源摘录 · NVD

漏洞预警2026-10-22 发布MEDIUM

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft....

CVE-2026-54532

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workfl

来源摘录 · NVD

安全公告2026-10-22 发布INFO

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into...

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-22 发布HIGH

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types fo...

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing

来源摘录 · NVD

安全公告2026-10-22 发布INFO

CVE-2026-114727

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-21 发布INFO

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to t...

CVE-2026-113461

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library direct

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-20 发布INFO

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for k...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-20 发布HIGH

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

CVE-2026-86949

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A ma

来源摘录 · NVD