2026-09-02 归档

今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-01 发布INFO

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of the component ACP...

CVE-2026-84288

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.promp

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-09-01 发布INFO

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Managem...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-01 发布INFO

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could ...

CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-918

漏洞预警2026-09-01 发布INFO

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation ...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code e

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-01 发布INFO

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated us...

CVE-2026-19118

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-01 发布INFO

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups w...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bul

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-01 发布INFO

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, ...

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-184

漏洞预警2026-09-01 发布INFO

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package ...

CVE-2026-84368

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-09-01 发布INFO

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by o...

CVE-2026-84367

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-09-01 发布INFO

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-schem...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every travers...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested object...

CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment a...

CVE-2026-84363

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query help

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-01 发布INFO

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted compose...

CVE-2026-84361

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-01 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_...

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/

历史摘要 · 未重新核验 · NVD

#cve #cwe-834

漏洞预警2026-09-01 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and ...

CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/

历史摘要 · 未重新核验 · NVD

#cve #cwe-405 #cwe-834

漏洞预警2026-09-01 发布INFO

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-service condition on...

CVE-2026-73783

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerabil...

CVE-2026-73782

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote c

历史摘要 · 未重新核验 · NVD

#cve