2026-09-02 归档

今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-02 发布INFO

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium se...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outs

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-02 发布INFO

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t...

CVE-2026-84323

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a mes...

CVE-2026-81928

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a me

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-01 发布INFO

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using...

CVE-2026-84483

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows una

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-09-01 发布INFO

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer o...

CVE-2026-84482

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-01 发布INFO

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unau...

CVE-2026-84481

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-01 发布INFO

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying dire...

CVE-2026-84478

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-09-01 发布INFO

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticate...

CVE-2026-84477

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). ...

CVE-2026-84476

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-01 发布INFO

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulati...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-09-01 发布INFO

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and...

CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's region

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-01 发布INFO

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could all...

CVE-2026-84642

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without es

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulne...

CVE-2026-84641

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap con

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbir...

CVE-2026-84640

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fix

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunde...

CVE-2026-84639

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment prot...

CVE-2026-84637

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows,

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sour...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-09-01 发布INFO

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-09-01 发布INFO

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/no...

CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-01 发布INFO

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. ...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-789