#severity:medium

共收录 5506 条相关情报。

漏洞预警2026-11-01 发布MEDIUM

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware....

CVE-2026-120192

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-200 #cwe-284 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers ca...

CVE-2026-120252

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Defin

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-121 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a craf...

CVE-2026-120251

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-835 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certif...

CVE-2026-120250

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and u

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-295 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-pr...

CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-352 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by u...

CVE-2026-120248

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administr

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short pa...

CVE-2026-120247

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attac

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-908 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries....

CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack mem

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-457 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit palette...

CVE-2026-120245

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks he

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-908 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Att...

CVE-2026-120244

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-908 #severity:medium

漏洞预警2026-11-01 发布MEDIUM

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette...

CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows at

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-457 #severity:medium

漏洞预警2026-11-01 发布HIGH

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authen...

CVE-2026-120191

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of t

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-287 #cwe-306 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component A...

CVE-2026-120185

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the fi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-266 #cwe-269 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path element...

CVE-2026-120210

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens ...

CVE-2026-120206

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forg

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-352 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the out...

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows rem

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via ses...

CVE-2026-120200

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate,

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attacke...

CVE-2026-120199

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated u

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to i...

CVE-2026-15272

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' paramet

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input san...

CVE-2026-96554

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium