openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost
CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication
CVE-2026-81094
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked
BlockScope: Detecting and Investigating Propagated Vulnerabilities in Forked Blockchain Projects.
本文针对区块链生态中普遍存在的代码分叉现象，提出了一种名为 BlockScope 的自动化工具，用于检测和调查分叉区块链项目中从经典链（如比特币和以太坊）传播而来的漏洞。由于区块链项目的开源特性，许多新链（如 Dogecoin、Liteco
In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister...
CVE-2026-80660
In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister sysfs devices outside occ l
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
CVE-2026-61802
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
CVE-2026-61800
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh agent enrollment NULL pointer dereference via malformed manager response
CVE-2026-54084
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
CVE-2026-54713
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() gener
openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2
CVE-2026-81720
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing
openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing
CVE-2026-81706
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore,
openssl_encrypt before 1.4.9 Key Substitution via Identity Load
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, al
AVideo SSRF Guard Bypass via IPv6 Transition Addresses
CVE-2026-81678
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extr
Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
CVE-2026-81335
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch
Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List
CVE-2026-81095
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServ
Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton
CVE-2026-81093
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/co
mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in serv
Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler
CVE-2026-80209
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements