2026-09-03 归档

今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-01 发布INFO

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploit...

CVE-2026-73759

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state o...

CVE-2026-73758

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-01 发布INFO

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful...

CVE-2026-73757

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-01 发布INFO

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitatio...

CVE-2026-73756

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive informati

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-09-01 发布INFO

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required use...

CVE-2026-73755

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-01 发布INFO

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a v...

CVE-2026-73754

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying opera...

CVE-2026-73753

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-01 发布INFO

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary fi...

CVE-2026-73752

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-01 发布INFO

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating ...

CVE-2026-73751

An authenticated user with low-privileged access could submit crafted input through the web-based management interface t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-01 发布INFO

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities...

CVE-2026-73750

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-01 发布INFO

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP o...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitra

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-01 发布INFO

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode...

CVE-2026-63435

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Ut

历史摘要 · 未重新核验 · NVD

#cve #cwe-436

漏洞预警2026-09-01 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeOb...

CVE-2026-84309

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-01 发布INFO

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the m...

CVE-2026-84307

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-09-01 发布INFO

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM ...

CVE-2026-78608

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authori

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-01 发布INFO

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference e...

CVE-2026-78607

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-01 发布INFO

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Unde...

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to informati

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-01 发布INFO

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated u...

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-01 发布INFO

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAP...

CVE-2026-78597

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-01 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversa...

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-22