2026-09-04 归档

今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-09-03 发布INFO

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sa...

CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-03 发布INFO

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s...

CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-09-03 发布INFO

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s...

CVE-2026-85045

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-03 发布INFO

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via ...

CVE-2026-85044

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker lever

历史摘要 · 未重新核验 · NVD

#cve #cwe-672

漏洞预警2026-09-03 发布INFO

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium secur...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-09-03 发布INFO

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter k...

CVE-2026-82527

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-03 发布INFO

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attack...

CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identi

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-601

漏洞预警2026-09-03 发布INFO

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secr...

CVE-2026-44506

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-03 发布INFO

IBM Qiskit SDK 2.1.0 through 2.5.1 could allow a local attacker to cause a denial of service due to improper handling of a specially crafted object during deserialization. A mal...

CVE-2026-19795

IBM Qiskit SDK 2.1.0 through 2.5.1 could allow a local attacker to cause a denial of service due to improper handling of

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-03 发布INFO

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trail...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-03 发布INFO

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with min...

CVE-2026-85395

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes ins...

CVE-2026-85393

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 sign

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-03 发布INFO

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions f...

CVE-2026-85392

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administra...

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deleti

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data....

CVE-2026-85389

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expr...

CVE-2026-85388

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-03 发布INFO

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwi...

CVE-2026-85205

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addw

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-03 发布INFO

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 migh...

CVE-2026-85028

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component

历史摘要 · 未重新核验 · NVD

#cve #cwe-379

漏洞预警2026-09-03 发布INFO

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVE-2026-82302

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrect

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-03 发布INFO

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVE-2026-82299

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-863