2026-09-01 归档

今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。

漏洞预警2026-08-31 发布INFO

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-con...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the d

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-08-31 发布INFO

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settin...

CVE-2026-52730

Xibo is an open source digital signage platform with a web content management system and Windows display player software

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted P...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a ...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the d...

CVE-2026-51738

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted ...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST reques...

CVE-2026-51736

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted PO...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via se...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a cra...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a ...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST reque...

CVE-2026-51731

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destru...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-08-31 发布INFO

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissi...

CVE-2026-83497

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-31 发布INFO

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handl...

CVE-2026-82818

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/r

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-08-31 发布INFO

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled...

CVE-2026-72001

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-31 发布INFO

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/f...

CVE-2026-53553

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200

漏洞预警2026-08-31 发布INFO

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-693 #cwe-918

漏洞预警2026-08-31 发布INFO

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved ext...

CVE-2026-53507

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918 #cwe-1188

漏洞预警2026-08-31 发布INFO

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a b...

CVE-2026-14696

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bri

历史摘要 · 未重新核验 · NVD

#cve #cwe-401