2026-08-25 归档

今日共收录 1135 条安全情报，包含 329 个 CVE，404 篇安全通告，以及 111 篇研究论文。

漏洞预警2026-08-24 发布INFO

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutr...

CVE-2026-9254

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, B

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack withou...

CVE-2026-78475

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin al

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-24 发布INFO

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the...

CVE-2026-76838

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backen

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-24 发布INFO

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mentio...

CVE-2026-76837

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/acco

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-24 发布INFO

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/E...

CVE-2026-76836

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission gu

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-863

漏洞预警2026-08-24 发布INFO

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objec...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in e...

CVE-2026-76072

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattende

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-08-24 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-71982

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username an...

CVE-2026-71943

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerabili

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver em...

CVE-2026-71942

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver emai...

CVE-2026-71941

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field int...

CVE-2026-71940

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function.

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into...

CVE-2026-71939

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. T

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field ...

CVE-2026-71938

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the st...

CVE-2026-71937

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data i...

CVE-2026-71936

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the ...

CVE-2026-71935

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count,...

CVE-2026-71934

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the opti...

CVE-2026-71932

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the file...

CVE-2026-71931

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-78