#severity:high

共收录 5396 条相关情报。

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_fil...

CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relat

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #cwe-73 #severity:high

漏洞预警2026-10-30 发布HIGH

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the con...

CVE-2026-116247

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one coul

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWOR...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrot

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-214 #cwe-526 #severity:high

漏洞预警2026-10-30 发布HIGH

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or clie...

CVE-2026-116245

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-522 #cwe-862 #severity:high

漏洞预警2026-10-30 发布HIGH

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to t...

CVE-2026-116244

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME fro

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under ...

CVE-2026-116243

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-426 #cwe-427 #severity:high

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh ...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1188 #cwe-522 #severity:high

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers t...

CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #cwe-367 #severity:high

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerbe...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-287 #cwe-639 #severity:high

漏洞预警2026-10-30 发布HIGH

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

CVE-2026-115830

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:high

漏洞预警2026-10-30 发布HIGH

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.

CVE-2026-115829

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successful

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-288 #severity:high

漏洞预警2026-10-30 发布HIGH

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

CVE-2026-94175

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-30 发布HIGH

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

CVE-2026-78527

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high

漏洞预警2026-10-30 发布HIGH

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

CVE-2026-73186

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high

漏洞预警2026-10-30 发布HIGH

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of s...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #severity:high

漏洞预警2026-10-29 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document excee...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-400 #cwe-401 #pip #severity:high

漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that ...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while openi

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-400 #cwe-770 #pip #severity:high

漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted en...

CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory wh

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #cwe-770 #pip #severity:high

漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested pars...

CVE-2026-119207

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #cwe-405 #pip #severity:high

漏洞预警2026-10-29 发布HIGH

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label n...

CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-400 #pip #severity:high