#cwe-829

共收录 170 条相关情报。

← 返回所有主题
漏洞预警2026-10-20 发布HIGH

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.

CVE-2026-86948

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An a

来源摘录 · NVD

漏洞预警2026-10-15 发布HIGH

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in th...

CVE-2026-111357

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, le

来源摘录 · NVD

安全公告2026-10-15 发布INFO

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

CVE-2026-86063

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git check

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-13 发布HIGH

Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-85355

Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized a

来源摘录 · NVD

漏洞预警2026-10-13 发布INFO

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build....

CVE-2026-55675

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb

历史摘要 · 未重新核验 · NVD

安全公告2026-10-13 发布INFO

Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

CVE-2026-55675

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-11 发布INFO

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because...

CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-11 发布INFO

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executab...

CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into

历史摘要 · 未重新核验 · NVD

安全公告2026-10-11 发布INFO

CVE-2026-108913

CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-09 发布INFO

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` su...

CVE-2026-92705

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation script

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-09 发布INFO

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privile...

CVE-2026-78019

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality f

历史摘要 · 未重新核验 · NVD

安全公告2026-10-07 发布INFO

Docling imports plugin entry points before the allow_external_plugins check

CVE-2026-105745

### Summary `allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own m

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-06 发布INFO

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

CVE-2026-86540

## Overview A critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-05 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factorie...

CVE-2026-105745

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to exec...

CVE-2026-105677

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme transla

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-05 发布INFO

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and ho...

CVE-2026-12171

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut

历史摘要 · 未重新核验 · NVD

安全公告2026-10-05 发布INFO

auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

CVE-2026-12171

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-05 发布INFO

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be load...

CVE-2026-63277

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document cou

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-05 发布INFO

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required t...

CVE-2026-104811

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected insta

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-05 发布INFO

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The l...

CVE-2026-104809

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled

历史摘要 · 未重新核验 · NVD