2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-29 发布MEDIUM

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform...

CVE-2026-76546

CVE-2026-76546 是 WordPress 插件 User Profile Builder 中一个存储型跨站脚本（Stored XSS）漏洞，影响 4.0.1 之前的版本。该插件用于构建用户资料页面，其中包含一个可选的短代码（sh

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布HIGH

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable cl...

CVE-2026-19430

CVE-2026-19430 涉及 WordPress 插件 Catfolders Document Gallery Pro 的访问控制缺陷。该插件 2.0.7 之前的版本中，部分 REST API 路由未进行授权检查，且用于标识请求内容的

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into it...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its setti

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated ...

CVE-2026-17520

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it serve...

CVE-2026-16600

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and ...

CVE-2026-16259

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthentic

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowi...

CVE-2026-16061

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers ...

CVE-2026-10522

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-29 发布INFO

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture adminis...

CVE-2026-41012

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vC

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-28 发布INFO

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResourc...

CVE-2026-55867

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-28 发布INFO

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authenticatio...

CVE-2026-55860

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2db

历史摘要 · 未重新核验 · NVD

#cve #cwe-319 #cwe-522

漏洞预警2026-08-28 发布INFO

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes...

CVE-2026-55858

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-838

漏洞预警2026-08-28 发布INFO

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be ...

CVE-2026-55857

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-319 #cwe-522

漏洞预警2026-08-28 发布INFO

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects ...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-08-28 发布INFO

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js...

CVE-2026-55855

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-116

漏洞预警2026-08-28 发布INFO

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js...

CVE-2026-55854

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-319 #cwe-522

漏洞预警2026-08-28 发布INFO

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-contr...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-08-28 发布INFO

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog p...

CVE-2026-55841

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylo

历史摘要 · 未重新核验 · NVD

#cve #cwe-138

漏洞预警2026-08-28 发布INFO

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/u...

CVE-2026-55785

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptograph

历史摘要 · 未重新核验 · NVD

#cve #cwe-208 #cwe-385 #cwe-532

漏洞预警2026-08-28 发布INFO

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map...

CVE-2026-55784

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores

历史摘要 · 未重新核验 · NVD

#cve #cwe-362