In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in...
CVE-2026-80896
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_d
2026-09-05 归档
今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc...
CVE-2026-80885
In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-18745
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
CVE-2026-75911
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
CVE-2026-75912
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
CVE-2026-75856
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
CVE-2026-75857
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
CVE-2026-75859
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
CVE-2026-75914
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
SurrealDB allows bypass of deny-net flags via DNS resolution
CVE-2025-71390
SurrealDB offers http functions that can access external network endpoints. A typical, albeit [not recommended ](https:/
SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking
CVE-2026-72801
**CVE:** This vulnerability corresponds to [CVE-2026-72801](https://nvd.nist.gov/vuln/detail/CVE-2026-72801). ### Summa
PatchBench: Evaluating AI Agents for Vulnerability Patching
近年来，AI代理在自动漏洞修补方面展现出较强的能力，然而现有评估方法通常仅通过验证提供的PoC输入是否仍触发崩溃来判断补丁是否有效，这存在两个关键的有效性威胁：一是代理可能复现记忆的历史开发者补丁，而非真正理解漏洞；二是可能生成仅抑制崩溃的
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply U...
CVE-2026-86100
CVE-2026-86100 是 Camaleon CMS 中存在的一处服务器端请求伪造（SSRF）漏洞。Camaleon CMS 版本 2.7.5 至 2.9.1 的“Upload from URL”（从 URL 上传）媒体功能在获取远程
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Becau...
CVE-2026-52774
该漏洞位于 YesWiki 的 Bazar 扩展组件中。YesWiki 是一个基于 PHP 的 wiki 系统，Bazar 用于表单/数据管理。在版本 4.6.6 之前，/widget 路由对 GET 参数 id 的值在输出到 HTML 属
YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in...
CVE-2026-52773
YesWiki 是一套由 PHP 编写的 wiki 系统。该漏洞存在于其归档修订版本视图中，影响版本为 4.1.0 至 4.6.5（不含 4.6.6），修复版本为 4.6.6。具体问题位于 handlers/page/show.php 文件
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / que...
CVE-2026-52770
CVE-2026-52770 是 YesWiki（一个基于 PHP 的 wiki 系统）中的安全漏洞。受影响版本为 4.6.6 之前的版本。漏洞位于 YesWiki 公开的 Bazar 条目列表 API 中，具体存在于数字型查询/过滤器参数
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template fea...
CVE-2026-52762
CVE-2026-52762 是 YesWiki（基于 PHP 的 wiki 系统）中存在的一个存储型服务端模板注入（SSTI）漏洞，影响 4.6.6 之前的版本。漏洞位于 Bazar 组件的语义模板功能中。具有管理员权限的认证用户可以在
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attacker...
CVE-2026-86098
CVE-2026-86098 是 ntop nDPI 库（6.0 之前版本）中的一个堆缓冲区溢出漏洞，位于 ndpi_json_string_escape 函数。该函数在处理需要被 JSON 转义的字符串时，未能正确检查目标缓冲区的剩余空间
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash t...
CVE-2026-86097
PX4 Autopilot 1.17.0及之前版本中的 param_set_default_file() 和 param_set_backup_file() 函数存在空指针解引用漏洞。攻击者可在任意PX4 shell中执行 'param s
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attack...
CVE-2026-86096
PX4 Autopilot 是一套广泛用于无人机和其他无人系统的开源飞行控制软件。本次漏洞（CVE-2026-86096）影响 1.17.0 及之前版本，具体位置在温度校准模块的 TemperatureCalibration::start(