#severity:high

共收录 5396 条相关情报。

← 返回所有主题
漏洞预警2026-10-31 发布HIGH

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as th...

CVE-2026-116520

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formDat...

CVE-2026-109997

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5...

CVE-2026-109234

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access...

CVE-2026-116755

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f

来源摘录 · NVD / GitHub Advisory

安全公告2026-10-30 发布HIGH

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

CVE-2026-118761

## Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expand

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

CVE-2026-118759

## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

CVE-2026-119203

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires openi

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage when parsing page tree

CVE-2026-119204

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible infinite loop when cloning dictionaries

CVE-2026-119205

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloni

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

CVE-2026-118772

### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

CVE-2026-119202

### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token w

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

Authlib RFC 7592 examples omit registration-access-token client binding

CVE-2026-116672

## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously regi

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible long runtimes when retrieving page labels

CVE-2026-119206

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retriev

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage for exceptions in strict mode

CVE-2026-119207

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loa

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible long runtimes/large memory usage for encrypted PDF files

CVE-2026-119208

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This req

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pypdf has possible large memory usage when parsing cross-reference streams

CVE-2026-119209

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires ope

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

CVE-2026-119196

## Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pyasn1 has quadratic-complexity denial of service in binary REAL decoding

CVE-2026-119197

## Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time

来源摘录 · GitHub Advisory

安全公告2026-10-30 发布HIGH

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

CVE-2026-119195

## Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments

来源摘录 · GitHub Advisory