2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-28 发布INFO

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_po...

CVE-2026-75121

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-b

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-28 发布INFO

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirec...

CVE-2026-55834

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0,

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-28 发布INFO

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate comman...

CVE-2026-55673

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandEx

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-08-28 发布INFO

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Fo...

CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-08-28 发布INFO

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.File...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the hand

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/s...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsol...

CVE-2026-55552

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated r

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/au...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileg...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. Pac...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPac

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every aster...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URL

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-08-28 发布INFO

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-28 发布INFO

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to b...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-269 #cwe-863

漏洞预警2026-08-28 发布INFO

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeReq...

CVE-2026-55484

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-754

漏洞预警2026-08-28 发布INFO

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/gray...

CVE-2026-55425

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity

历史摘要 · 未重新核验 · NVD

#cve #cwe-213

漏洞预警2026-08-28 发布INFO

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_r...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-28 发布INFO

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFrom...

CVE-2026-55220

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled wit...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-522

漏洞预警2026-08-28 发布INFO

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote c...

CVE-2026-55108

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-400