In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write()...
CVE-2026-89697
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATT
2026-09-12 归档
今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Shopper: Missing authorization on product removal actions in CollectionProducts component
CVE-2026-56825
## Title Missing authorization on product removal actions in CollectionProducts component ## Description A lack of au
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
CVE-2026-56830
## Title Missing authorization on Media sub-form store action allows unpermissioned product media update ## Descriptio
Shopper: privilege escalation via improper Livewire admin component authorization
CVE-2026-56828
## Summary Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.
Shopping privilege escalation through missing authorization in Settings components
CVE-2026-56826
## Summary Four Livewire components in the Settings area expose destructive Filament actions (`delete` / `edit`) that p
Shopper: Negative discount values accepted and propagated through order calculation pipeline
CVE-2026-56831
## Summary The Shopper Framework discount management functionality accepts negative discount values without server-side
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
CVE-2026-56827
## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
CVE-2026-11745
# Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that retu
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
CVE-2026-11746
## Vulnerability `ZooKeeperReplicationConfig.secret()` silently substitutes the hard-coded constant `"ch4n63m3"` (leets
Traefik entrypoint header-name sanitization bypassed via request trailers
CVE-2026-88004
## Summary Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHea
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
CVE-2026-88014
### Summary `backend/archive` mounts a zip file as a browsable, syncable rclone `Fs` (e.g. `rclone lsf :zip:downloaded.z
rclone: http backend forwards custom/auth headers to a different host on redirect
CVE-2026-88013
## Vulnerability Details **File**: `backend/http/http.go` **Lines**: 285 (client construction — no `CheckRedirect`), 50
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
CVE-2026-88016
## Summary With `-l/--links`, rclone's local backend recreates a source `.rclonelink` object as a real symlink at the de
rclone local: crafted Range request against a translated symlink panics (DoS)
CVE-2026-88015
### Summary When `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is expose
Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability
该论文聚焦工业物联网（IIoT）中传感器节点的安全关键性评估问题。IIoT 传感器依赖实时数据调控生产流程，一旦遭受网络攻击，可能同时损害数据可靠性与产品质量。既有研究要么仅从网络安全漏洞与攻击影响角度对节点排序，要么仅依据传感器数据对产品
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-se...
CVE-2026-89267
CVE-2026-89267 涉及 Python 生态中常用的 Starlette 后台管理框架扩展 starlette-admin。该框架允许开发者通过配置项 searchable_fields 声明哪些模型字段可以被前端搜索/过滤, 以
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
CVE-2026-90461
OpenStack Ironic 是一个用于裸金属节点部署和管理的服务。CVE-2026-90461 指出，在 Ironic 38.0.0 及之前版本中，当 Image Service（镜像服务）配置为使用 HTTP(S) Basic Au
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a ...
CVE-2026-90455
该条目描述的是一个由依赖版本回滚（revert）导致的漏洞重新引入问题，而非新披露的独立缺陷。事件经过是：此前的一次更新曾把某个组件内捆绑（bundled）的 HTTP 客户端库升级到已修复若干已知漏洞的较新版本，但在后续变更中这次升级被回
京公网安备 11000002002063号
本条输入并非一篇威胁情报文章，而是一次数据采集或解析异常所产生的记录。其 title 字段为“京公网安备 11000002002063号”，这是中国大陆网站依规在页面底部展示的公安联网备案编号；source_url 指向 beian.gov
（总）网出证（京）字第281号
本条记录的实际内容并非威胁情报报告，而是 360 公司官网的资质证照页面（工信部/网信办备案类文件），标题“（总）网出证（京）字第281号”属于北京地区网络出版/信息服务相关许可证编号格式，页面地址为 https://www.360.cn/