安全日报 - 2026-09-09 - Cyber Security Daily Radar

安全公告2026-09-08 发布INFO

Workload identity attestation generated before login host validation in Snowflake drivers

CVE-2026-86600

In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-441 #cwe-522

安全公告2026-09-08 发布INFO

snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

CVE-2026-86735

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-09-08 发布INFO

WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize

CVE-2026-86729

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307

安全公告2026-09-08 发布INFO

AVideo through 29.0 Information Disclosure via restreamsActive.json.php

CVE-2026-86726

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-522

安全公告2026-09-08 发布INFO

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. Th

历史摘要 · 未重新核验 · OSV.dev

#advisory

安全公告2026-09-08 发布INFO

CVE-2026-86590

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-09-08 发布INFO

Sensitive information written to logs by Snowflake drivers

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-532

安全公告2026-09-08 发布INFO

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-129 #cwe-248 #severity:high

学术论文2026-09-07 发布MEDIUM

Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels

该论文揭示了 SSH 协议在通道复用场景下存在一个此前未被发现的压缩侧信道漏洞。SSH 是服务器远程安全管理的标准协议，其传输层使用二进制包协议（BPP）进行加密和认证，而连接协议则在单一连接上复用多个逻辑通道，用于交互式 shell、端口

历史摘要 · 未重新核验 · Apple Security Releases

#apple #ios #macos

安全公告2026-09-09 发布INFO

iOS 26.3 and iPadOS 26.3

历史摘要 · 未重新核验 · Apple Security Releases

#apple #ios #macos

2026-09-09 归档