2026-09-11 归档

今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-09 发布INFO

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of th...

CVE-2026-87923

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. A

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-09-09 发布INFO

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, me...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows r

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-09 发布INFO

The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination ch...

CVE-2026-15460

The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c disp

历史摘要 · 未重新核验 · NVD

#cve #cwe-666

漏洞预警2026-09-09 发布INFO

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could...

CVE-2026-88069

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/util...

CVE-2026-88002

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the messa

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or p...

CVE-2026-88001

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-si

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-his...

CVE-2026-88000

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retr

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in b...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils....

CVE-2026-87996

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlayw

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered termi...

CVE-2026-87995

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-1021

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.p...

CVE-2026-87994

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the chann

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-09 发布INFO

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOper...

CVE-2026-87922

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e0

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-09-09 发布INFO

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file include...

CVE-2026-87921

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. A

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend...

CVE-2026-87016

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user

历史摘要 · 未重新核验 · NVD

#cve #cwe-155 #cwe-287

漏洞预警2026-09-09 发布INFO

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any typ...

CVE-2026-75308

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks fi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-09 发布INFO

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-09 发布INFO

In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whethe...

CVE-2026-71807

In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-09 发布INFO

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mai...

CVE-2026-15913

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the ...

CVE-2026-87015

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/

历史摘要 · 未重新核验 · NVD

#cve #cwe-201