2026-08-25 归档

今日共收录 1135 条安全情报，包含 329 个 CVE，404 篇安全通告，以及 111 篇研究论文。

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the ...

CVE-2026-71908

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves fi...

CVE-2026-71907

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability i

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetm...

CVE-2026-71906

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is c

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey,...

CVE-2026-71905

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous cha...

CVE-2026-71904

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Si...

CVE-2026-34491

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls M

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-24 发布INFO

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs...

CVE-2026-13213

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set uncondit

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-08-24 发布INFO

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image...

CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plu

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-24 发布INFO

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory travers...

CVE-2026-77914

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76831

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-24 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76830

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-24 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76829

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-24 发布INFO

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1....

CVE-2026-75099

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-24 发布INFO

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 ...

CVE-2026-19685

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued conn

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-24 发布INFO

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.

CVE-2026-18349

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injectio

历史摘要 · 未重新核验 · NVD

#cve #cwe-1247

漏洞预警2026-08-24 发布INFO

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group p...

CVE-2026-15469

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-08-24 发布INFO

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

CVE-2025-36940

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from U

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-08-24 发布INFO

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a deni...

CVE-2025-36939

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread net

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-08-24 发布INFO

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search con...

CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-08-24 发布INFO

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use n...

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Matterm

历史摘要 · 未重新核验 · NVD

#cve #cwe-918