2026-09-06 归档

今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。

漏洞预警2026-09-06 发布HIGH

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID ca...

CVE-2026-86159

SourceCodester Online Voting System 1.0 存在 SQL 注入漏洞。该漏洞位于文件 /ajax.php?action=save_user 的未知函数中，攻击者可以通过操纵参数 ID 触发 SQL 注入。攻

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-05 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76160

该CVE编号已被CVE编号机构（CNA）拒绝或撤回。记录显示无CVSS评分、无EPSS分数、无受影响产品信息，也未列入已知被利用漏洞（KEV）目录或在野利用标记。因此该CVE不代表任何实际安全漏洞或风险，不应被当作有效公告处理。

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

CVE-2026-86206

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is

历史摘要 · 未重新核验 · NVD

#cve #cwe-791

漏洞预警2026-09-05 发布INFO

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

CVE-2026-86207

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

历史摘要 · 未重新核验 · NVD

#cve #cwe-305

漏洞预警2026-09-05 发布INFO

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop ite...

CVE-2026-6554

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via bac

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-05 发布INFO

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter pro...

CVE-2026-6244

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zer

历史摘要 · 未重新核验 · NVD

#cve #cwe-369

漏洞预警2026-09-05 发布INFO

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that tr...

CVE-2026-31912

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instructio

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-823 #cwe-1285

漏洞预警2026-09-05 发布INFO

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the...

CVE-2026-31911

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular unco

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-09-05 发布INFO

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks ...

CVE-2026-18313

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-05 发布INFO

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and ca...

CVE-2026-18238

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its heade

历史摘要 · 未重新核验 · NVD

#cve #cwe-126 #cwe-1288

漏洞预警2026-09-05 发布INFO

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interprete...

CVE-2026-0799

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit i

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-129 #cwe-787

漏洞预警2026-09-05 发布INFO

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint...

CVE-2026-82752

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-09-05 发布INFO

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output ...

CVE-2026-86197

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect ...

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-05 发布INFO

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super fla...

CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where t

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-05 发布INFO

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login...

CVE-2026-86194

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-05 发布INFO

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Att...

CVE-2026-86193

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing no

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-05 发布INFO

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payl...

CVE-2026-86192

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys end

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-05 发布INFO

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute...

CVE-2026-86191

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-05 发布INFO

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers vi...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79