2026-09-03 归档

今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-02 发布INFO

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.a...

CVE-2026-84431

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.c

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-02 发布INFO

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the ver...

CVE-2026-82968

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-02 发布INFO

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal se...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-02 发布INFO

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write a...

CVE-2026-84701

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-02 发布INFO

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) th...

CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-02 发布INFO

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side reque...

CVE-2026-84697

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/614

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-02 发布INFO

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanis...

CVE-2026-84696

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA in

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-02 发布INFO

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without conten...

CVE-2026-84695

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-02 发布INFO

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell me...

CVE-2026-84694

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-02 发布INFO

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the compone...

CVE-2026-84430

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update

历史摘要 · 未重新核验 · NVD

#cve #cwe-913 #cwe-915

漏洞预警2026-09-02 发布INFO

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a man...

CVE-2026-84427

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-09-02 发布INFO

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. ...

CVE-2026-84425

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tool

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-09-02 发布INFO

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML ...

CVE-2026-84359

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-02 发布INFO

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a ...

CVE-2026-84358

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had com

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-02 发布INFO

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted netw...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-02 发布INFO

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-84356

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address ba

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-09-02 发布INFO

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via ...

CVE-2026-84355

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside...

CVE-2026-84351

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromis

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-02 发布INFO

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI I...

CVE-2026-84350

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineeri

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-02 发布INFO

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbo...

CVE-2026-84349

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend

历史摘要 · 未重新核验 · NVD

#cve #cwe-416