2026-09-03 归档

今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-02 发布INFO

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium s...

CVE-2026-84348

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak s

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-02 发布INFO

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securi...

CVE-2026-84347

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code ins

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-02 发布INFO

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t...

CVE-2026-84335

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local pr...

CVE-2026-84334

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium...

CVE-2026-84332

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass syst

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a cra...

CVE-2026-84331

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium securi...

CVE-2026-84330

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-451

漏洞预警2026-09-02 发布INFO

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive ...

CVE-2026-84329

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-09-02 发布INFO

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a ...

CVE-2026-84328

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information...

CVE-2026-84327

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leve

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-02 发布INFO

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...

CVE-2026-84326

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-09-02 发布INFO

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t...

CVE-2026-84323

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a mes...

CVE-2026-81928

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a me

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-01 发布INFO

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer o...

CVE-2026-84482

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-01 发布INFO

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unau...

CVE-2026-84481

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-01 发布INFO

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticate...

CVE-2026-84477

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). ...

CVE-2026-84476

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-01 发布INFO

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulati...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-09-01 发布INFO

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and...

CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's region

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-01 发布INFO

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could all...

CVE-2026-84642

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without es

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333