2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-28 发布INFO

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft ...

CVE-2026-82264

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant adm...

CVE-2026-82263

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint th

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-28 发布INFO

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant ad...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-28 发布INFO

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a th...

CVE-2026-82021

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remot

历史摘要 · 未重新核验 · NVD

#cve #cwe-494

漏洞预警2026-08-28 发布INFO

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credent...

CVE-2026-82020

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can in

历史摘要 · 未重新核验 · NVD

#cve #cwe-552

漏洞预警2026-08-28 发布INFO

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whos...

CVE-2026-81849

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-08-28 发布INFO

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by pas...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

漏洞预警2026-08-28 发布INFO

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE state...

CVE-2026-77586

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copie...

CVE-2026-77218

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-b

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_r...

CVE-2026-77217

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer derefere

历史摘要 · 未重新核验 · NVD

#cve #cwe-121 #cwe-476

漏洞预警2026-08-28 发布INFO

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements wit...

CVE-2026-77184

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comme

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-28 发布INFO

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output con...

CVE-2026-76798

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its genera

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-28 发布INFO

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications ...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutr

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-08-28 发布INFO

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted m...

CVE-2026-76794

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-28 发布INFO

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS comman...

CVE-2026-75486

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .verv

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy a...

CVE-2026-75126

PLANET GS-4210-16P2S firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handl...

CVE-2026-75125

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /c

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function...

CVE-2026-75124

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the w

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorpo...

CVE-2026-75123

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-b

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in ...

CVE-2026-75122

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-b

历史摘要 · 未重新核验 · NVD

#cve #cwe-78