2026-09-04 归档

今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-03 发布INFO

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The pla...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments b

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-03 发布INFO

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the com...

CVE-2026-85107

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFro

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-03 发布INFO

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the componen...

CVE-2026-85106

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-03 发布INFO

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manip...

CVE-2026-85105

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-03 发布INFO

Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with ...

CVE-2026-85093

Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retriev

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-03 发布INFO

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the oper

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-09-03 发布INFO

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale externa...

CVE-2026-85091

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when proces

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-03 发布INFO

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during A

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-03 发布INFO

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/i...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserv

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-09-03 发布INFO

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

CVE-2026-85084

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX

历史摘要 · 未重新核验 · NVD

#cve #cwe-129 #cwe-787

漏洞预警2026-09-03 发布INFO

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval o

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-03 发布INFO

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_a...

CVE-2026-85030

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element i

历史摘要 · 未重新核验 · NVD

#cve #cwe-840

漏洞预警2026-09-03 发布INFO

XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, t...

CVE-2026-82918

XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity refere

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security_get_permissions() maps an inhe...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_write_load() calls selinux_policy_cancel(...

CVE-2026-80756

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that nev

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm_read() bounds a permission val...

CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the cl

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitt...

CVE-2026-80754

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electro

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the controller state with spi...

CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psx

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the...

CVE-2026-80751

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_m

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-03 发布INFO

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up seve...

CVE-2026-80750

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_nod

历史摘要 · 未重新核验 · NVD

#cve