2026-09-01 归档

今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。

漏洞预警2026-08-31 发布INFO

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side re...

CVE-2026-81889

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL up

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is ...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-08-31 发布INFO

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryS...

CVE-2026-81887

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-1321

漏洞预警2026-08-31 发布INFO

Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

CVE-2026-81778

Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

CVE-2026-81768

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

CVE-2026-81765

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

CVE-2026-81764

Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

CVE-2026-81762

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

CVE-2026-81758

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

CVE-2026-81298

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81297

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-08-31 发布INFO

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

CVE-2026-81291

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

CVE-2026-81290

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

CVE-2026-81287

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-31 发布INFO

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

CVE-2026-81280

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-08-31 发布INFO

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 thr...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Secur

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject mali...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistor

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path arg

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_dat...

CVE-2026-79407

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the

历史摘要 · 未重新核验 · NVD

#cve