2026-09-05 归档

今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-09-04 发布INFO

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipula...

CVE-2026-85512

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-09-04 发布INFO

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transforma...

CVE-2026-84428

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a rout

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-09-04 发布INFO

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing ...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip di

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-04 发布INFO

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attac...

CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user...

CVE-2026-4644

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-04 发布INFO

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a throug...

CVE-2026-27347

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Secur

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as ...

CVE-2026-85547

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disable

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-04 发布INFO

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share t...

CVE-2026-85546

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOr

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-04 发布INFO

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via...

CVE-2026-85541

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVE-2026-85540

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-04 发布INFO

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that p...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protoco

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-04 发布INFO

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema tha...

CVE-2026-84469

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schem

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-04 发布INFO

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticate...

CVE-2026-84044

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-04 发布INFO

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-04 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/...

CVE-2026-27086

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart al

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. This issue affects smartLink HW-PN: from 1.04 before 1.10.

CVE-2026-13148

Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-04 发布INFO

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permiss...

CVE-2026-85538

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite la

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-04 发布INFO

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In ...

CVE-2026-85533

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be red...

CVE-2026-85528

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-09-04 发布INFO

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were n...

CVE-2026-85525

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-347