2026-09-04 归档

今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-09-03 发布INFO

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not prov...

CVE-2026-53720

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-787 #cwe-1284

漏洞预警2026-09-03 发布INFO

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query paramet...

CVE-2026-50554

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-285

漏洞预警2026-09-03 发布INFO

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in Block...

CVE-2026-48486

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algori

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-03 发布INFO

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered a...

CVE-2026-85230

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-79

漏洞预警2026-09-03 发布INFO

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL paramete...

CVE-2026-85227

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-03 发布INFO

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom Ld...

CVE-2026-85216

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficien

历史摘要 · 未重新核验 · NVD

#cve #cwe-521

漏洞预警2026-09-03 发布INFO

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request bo...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authentic...

CVE-2026-85213

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueE

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators a...

CVE-2026-85212

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage ...

CVE-2026-85211

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attack...

CVE-2026-85210

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Se...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23 #cwe-206

漏洞预警2026-09-03 发布INFO

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account...

CVE-2026-85182

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated cal

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker ca...

CVE-2026-85180

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to r

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadat...

CVE-2026-85179

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to interna

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault...

CVE-2026-85178

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox...

CVE-2026-85177

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can ...

CVE-2026-85176

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbi

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-09-03 发布INFO

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repositor...

CVE-2026-85135

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434