2026-09-11 归档

今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke...

CVE-2026-88939

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only ag

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Att...

CVE-2026-88938

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agen

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside ...

CVE-2026-88937

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ft...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.

历史摘要 · 未重新核验 · NVD

#cve #cwe-488

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rc...

CVE-2026-88016

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-281

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes s...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-248

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).read...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configu...

CVE-2026-88013

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-319 #cwe-522

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.re...

CVE-2026-88012

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User sur...

CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while...

CVE-2026-88009

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless

历史摘要 · 未重新核验 · NVD

#cve #cwe-444 #cwe-1286

漏洞预警2026-09-10 发布INFO

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scann...

CVE-2026-87913

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-283 #cwe-341

漏洞预警2026-09-10 发布INFO

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private so...

CVE-2026-87912

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-283 #cwe-341

漏洞预警2026-09-10 发布INFO

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentia...

CVE-2026-81052

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An una

历史摘要 · 未重新核验 · NVD

#cve #cwe-494

漏洞预警2026-09-10 发布INFO

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could p...

CVE-2026-81051

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-1328

漏洞预警2026-09-10 发布INFO

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially explo...

CVE-2026-81049

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high priv

历史摘要 · 未重新核验 · NVD

#cve #cwe-353

漏洞预警2026-09-10 发布INFO

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-09-10 发布INFO

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive informati...

CVE-2026-4130

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-09-10 发布INFO

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directo...

CVE-2026-4129

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-10 发布INFO

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content i...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862