2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-28 发布INFO

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions i...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMed

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-28 发布INFO

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separ...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

历史摘要 · 未重新核验 · NVD

#cve #cwe-117

漏洞预警2026-08-28 发布INFO

Rejected reason: This CVE ID was assigned to a reported vulnerability in the Customer Reviews for WooCommerce WordPress plugin and was never published. The report was withdrawn:...

CVE-2026-14942

Rejected reason: This CVE ID was assigned to a reported vulnerability in the Customer Reviews for WooCommerce WordPress

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-28 发布INFO

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or oth...

CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop cond

历史摘要 · 未重新核验 · NVD

#cve #cwe-606

漏洞预警2026-08-28 发布INFO

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An a...

CVE-2026-82261

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a C

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-28 发布INFO

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerabi...

CVE-2026-82260

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunction

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-28 发布INFO

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables e...

CVE-2026-82259

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experim

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context...

CVE-2026-82258

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-08-28 发布INFO

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. At...

CVE-2026-82257

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-08-28 发布INFO

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitat...

CVE-2026-82256

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the N

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-28 发布INFO

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after H...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-08-28 发布INFO

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send craft...

CVE-2026-82254

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-08-28 发布INFO

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the f...

CVE-2026-82253

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule n

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can c...

CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-28 发布INFO

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft mal...

CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when de

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads...

CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-08-28 发布INFO

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inj...

CVE-2026-82249

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-08-28 发布INFO

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink dur...

CVE-2026-82248

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-28 发布INFO

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. ...

CVE-2026-82247

gitoxide's gix-url crate (?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended h

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-08-28 发布INFO

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content...

CVE-2026-82246

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai

历史摘要 · 未重新核验 · NVD

#cve #cwe-918