2026-09-05 归档

今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-04 发布INFO

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator whe...

CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-

历史摘要 · 未重新核验 · NVD

#cve #cwe-129 #cwe-787

漏洞预警2026-09-04 发布INFO

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/ap...

CVE-2026-53761

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-04 发布INFO

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operat...

CVE-2026-53760

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handl

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML includi...

CVE-2026-53758

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating ent...

CVE-2026-53757

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP e

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account paramete...

CVE-2026-53756

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection i

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-04 发布INFO

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma ...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug val

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22

漏洞预警2026-09-04 发布INFO

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default Web...

CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a s

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-252

漏洞预警2026-09-04 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-18745

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-04 发布INFO

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original respons...

CVE-2026-18540

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier par

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-04 发布INFO

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of...

CVE-2026-18149

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful re

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-09-04 发布INFO

Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video stream...

CVE-2021-44320

Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-04 发布INFO

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenti...

CVE-2021-44319

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-F

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-04 发布INFO

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Be...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate i

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-04 发布INFO

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while th...

CVE-2026-85024

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zl

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-04 发布INFO

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean cl...

CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connect

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-754

漏洞预警2026-09-04 发布INFO

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe me...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by s

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-04 发布INFO

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent f...

CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and re

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-04 发布INFO

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the intercept...

CVE-2026-84947

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-248

漏洞预警2026-09-04 发布INFO

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-524