2026-09-05 归档

今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

CVE-2026-19304

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from i

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a re...

CVE-2026-19303

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or dir

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

CVE-2026-19302

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVE-2026-19301

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

CVE-2026-19300

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

CVE-2026-19299

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

CVE-2026-19298

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an au

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-04 发布INFO

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, cau...

CVE-2026-19283

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-04 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information ab...

CVE-2026-18887

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-04 发布INFO

IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.

CVE-2026-18858

IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SS

历史摘要 · 未重新核验 · NVD

#cve #cwe-267

漏洞预警2026-09-04 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writ...

CVE-2026-18567

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involv

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-04 发布INFO

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affectin...

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid se

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header...

CVE-2026-9186

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration i

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileCom...

CVE-2026-9138

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

CVE-2026-8447

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat int

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with ...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-09-04 发布INFO

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops....

CVE-2026-85699

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initia

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-04 发布INFO

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation....

CVE-2026-85698

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-04 发布INFO

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read...

CVE-2026-85697

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document vi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863