2026-09-11 归档

今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-10 发布INFO

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can ...

CVE-2026-88888

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependenci

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-10 发布INFO

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP L...

CVE-2026-88887

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagin

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-10 发布INFO

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Hel...

CVE-2026-88886

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions be

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-10 发布INFO

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySo...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depNam

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-10 发布INFO

Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovat...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-10 发布INFO

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart bef...

CVE-2026-88883

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-10 发布INFO

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm c...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts b

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-10 发布INFO

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, o...

CVE-2026-88881

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header whe

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-10 发布INFO

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. A...

CVE-2026-88880

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing mal

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-10 发布INFO

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-...

CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-10 发布INFO

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeou...

CVE-2026-88878

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through = v3.0.0 through .transport.responding

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-10 发布INFO

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attacke...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-10 发布INFO

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows incl...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive u

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-09-10 发布INFO

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin....

CVE-2026-88874

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream p

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-10 发布INFO

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated a...

CVE-2026-88873

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-10 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticat...

CVE-2026-88872

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-10 发布INFO

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin...

CVE-2026-88871

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request f

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-10 发布INFO

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CS...

CVE-2026-88870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-10 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields ar...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-10 发布INFO

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.p...

CVE-2026-88867

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-si

历史摘要 · 未重新核验 · NVD

#cve #cwe-79