2026-09-02 归档

今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-31 发布INFO

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 thr...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Secur

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-31 发布INFO

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject mali...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistor

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-31 发布INFO

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_dat...

CVE-2026-79407

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-31 发布INFO

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::t...

CVE-2026-75594

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's medi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-31 发布INFO

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks i...

CVE-2026-75592

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's medi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-31 发布INFO

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageR...

CVE-2026-75460

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-31 发布INFO

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface a...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an exis...

CVE-2026-61641

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallo

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating en...

CVE-2026-61639

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restor

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and s...

CVE-2026-61638

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notificat

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0...

CVE-2026-54179

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement...

CVE-2026-50198

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-31 发布INFO

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of a...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter v

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-31 发布INFO

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file...

CVE-2026-82835

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-08-31 发布INFO

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically ...

CVE-2026-82833

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Label

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-08-31 发布INFO

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-con...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the d

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-08-31 发布INFO

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a ...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-31 发布INFO

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted ...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-31 发布INFO

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted PO...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-31 发布INFO

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a ...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-284