2026-08-28 归档

今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-27 发布INFO

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose ass...

CVE-2026-81819

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-27 发布INFO

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administ...

CVE-2026-81818

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authori

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-27 发布INFO

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally recei...

CVE-2026-81817

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue acr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwr...

CVE-2026-81727

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-27 发布INFO

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attac...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-27 发布INFO

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malf...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-27 发布INFO

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by sup...

CVE-2026-81724

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unau

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-08-27 发布INFO

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block re...

CVE-2026-81723

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-27 发布INFO

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper w...

CVE-2026-81722

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-08-27 发布INFO

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. At...

CVE-2026-81721

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-27 发布INFO

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key ...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-27 发布INFO

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-bu...

CVE-2026-81719

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature pol

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-27 发布INFO

openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-...

CVE-2026-81718

openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect

历史摘要 · 未重新核验 · NVD

#cve #cwe-326

漏洞预警2026-08-27 发布INFO

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted ...

CVE-2026-81717

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-08-27 发布INFO

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefi...

CVE-2026-81716

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-27 发布INFO

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debu...

CVE-2026-81715

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the p

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-08-27 发布INFO

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who...

CVE-2026-81714

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-08-27 发布INFO

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries in...

CVE-2026-81706

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore,

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-27 发布INFO

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abb...

CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied vi

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-08-27 发布INFO

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2i...

CVE-2026-81704

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile

历史摘要 · 未重新核验 · NVD

#cve #cwe-916