2026-09-02 归档

今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-01 发布INFO

Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash...

CVE-2026-82744

Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controll

历史摘要 · 未重新核验 · NVD

#cve #cwe-636

漏洞预警2026-09-01 发布INFO

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actio...

CVE-2026-82743

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory....

CVE-2026-82742

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_w...

CVE-2026-82741

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type

历史摘要 · 未重新核验 · NVD

#cve #cwe-1287

漏洞预警2026-09-01 发布INFO

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid in...

CVE-2026-82740

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-01 发布INFO

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmat...

CVE-2026-82739

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-01 发布INFO

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attrib...

CVE-2026-82738

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-01 发布INFO

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535...

CVE-2026-82737

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-01 发布INFO

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match ...

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-09-01 发布INFO

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should ha...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expr

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constrai...

CVE-2026-82734

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-f

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-09-01 发布INFO

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deseriali...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-470 #cwe-610

漏洞预警2026-09-01 发布INFO

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data fro...

CVE-2026-82733

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-01 发布INFO

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controlle...

CVE-2026-82732

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-01 发布INFO

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated cl...

CVE-2026-82731

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who c

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-01 发布INFO

Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field poli...

CVE-2026-82730

Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-01 发布INFO

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error ...

CVE-2026-77950

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-01 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the ...

CVE-2026-77856

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-01 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the ...

CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-01 发布INFO

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18....

CVE-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, aff

历史摘要 · 未重新核验 · NVD

#cve #cwe-78