2026-09-01 归档

今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。

漏洞预警2026-08-31 发布INFO

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a craf...

CVE-2026-51674

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a cra...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a ...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware download state inf...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bo...

CVE-2026-51670

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via send...

CVE-2026-51669

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify language configuration via sending a craf...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot R...

CVE-2026-19702

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLG

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-31 发布INFO

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v...

CVE-2026-19616

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Const

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulatio...

CVE-2026-82696

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-31 发布INFO

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a t...

CVE-2026-74010

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affe...

CVE-2026-5956

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Sit

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-31 发布INFO

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via se...

CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization ...

CVE-2026-51666

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-31 发布INFO

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for l...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or em

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-08-31 发布INFO

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981...

CVE-2026-82797

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This i

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-08-31 发布INFO

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escap...

CVE-2026-76984

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHea

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, wh...

CVE-2026-76983

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor,...

CVE-2026-76982

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup with...

CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value

历史摘要 · 未重新核验 · NVD

#cve #cwe-79