2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-27 发布INFO

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary file...

CVE-2026-81838

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-08-27 发布INFO

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a...

CVE-2026-81834

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminal

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-08-27 发布INFO

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the com...

CVE-2026-81833

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94

漏洞预警2026-08-27 发布INFO

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ign...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-27 发布INFO

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttach...

CVE-2026-81730

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers with

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-27 发布INFO

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure...

CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-27 发布INFO

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import....

CVE-2026-81728

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-27 发布INFO

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be rep...

CVE-2026-81530

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-08-27 发布INFO

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into ...

CVE-2026-81529

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-27 发布INFO

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forward...

CVE-2026-81528

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-27 发布INFO

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter transla...

CVE-2026-81527

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-27 发布INFO

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to...

CVE-2026-81526

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding i

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-08-27 发布INFO

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namesp...

CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace ide

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-27 发布INFO

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the t...

CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-08-27 发布INFO

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. ...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-08-27 发布INFO

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a na...

CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embed

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-08-27 发布INFO

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the nam...

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserv

历史摘要 · 未重新核验 · NVD

#cve #cwe-99

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCred...

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public shar

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-08-27 发布INFO

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisio

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-787

漏洞预警2026-08-27 发布INFO

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary loca...

CVE-2026-75889

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor reso

历史摘要 · 未重新核验 · NVD

#cve #cwe-552