2026-09-04 归档

今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-03 发布INFO

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access wo...

CVE-2026-85173

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic che...

CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials t...

CVE-2026-85171

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailch

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-03 发布INFO

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated u...

CVE-2026-85170

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-03 发布INFO

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiri...

CVE-2026-85169

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI re

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-03 发布INFO

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys...

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, wh...

CVE-2026-85167

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-09-03 发布INFO

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow T...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-03 发布INFO

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve a...

CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-09-03 发布INFO

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and background...

CVE-2026-85164

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An a...

CVE-2026-85163

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. ...

CVE-2026-85162

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lac

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can ...

CVE-2026-85161

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbi

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting ...

CVE-2026-85160

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php t

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSaf...

CVE-2026-85159

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cance

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-03 发布INFO

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escap...

CVE-2026-85158

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-03 发布INFO

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter i...

CVE-2026-85157

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-03 发布INFO

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcod...

CVE-2026-85156

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-03 发布INFO

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order...

CVE-2026-85155

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APINam

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-03 发布INFO

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Diges...

CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an

历史摘要 · 未重新核验 · NVD

#cve #cwe-476