2026-09-03 归档

今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-01 发布INFO

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulne...

CVE-2026-84641

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap con

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-01 发布INFO

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbir...

CVE-2026-84640

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fix

历史摘要 · 未重新核验 · NVD

#cve #cwe-126

漏洞预警2026-09-01 发布INFO

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sour...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-09-01 发布INFO

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/no...

CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-01 发布INFO

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. ...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-09-01 发布INFO

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of the component ACP...

CVE-2026-84288

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.promp

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-09-01 发布INFO

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Managem...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-01 发布INFO

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation ...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code e

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-01 发布INFO

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated us...

CVE-2026-19118

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-01 发布INFO

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, ...

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-01 发布INFO

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package ...

CVE-2026-84368

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-09-01 发布INFO

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-schem...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested object...

CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment a...

CVE-2026-84363

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query help

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-01 发布INFO

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted compose...

CVE-2026-84361

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-01 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_...

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/

历史摘要 · 未重新核验 · NVD

#cve #cwe-834

漏洞预警2026-09-01 发布INFO

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-service condition on...

CVE-2026-73783

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-01 发布INFO

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerabil...

CVE-2026-73782

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote c

历史摘要 · 未重新核验 · NVD

#cve #cwe-134

漏洞预警2026-09-01 发布INFO

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an adm...

CVE-2026-73781

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct

历史摘要 · 未重新核验 · NVD

#cve #cwe-79