2026-09-12 归档

今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-11 发布INFO

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other u...

CVE-2026-89264

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-11 发布INFO

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for ar...

CVE-2026-89263

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-11 发布INFO

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the au...

CVE-2026-89262

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs owner

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-11 发布INFO

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter ...

CVE-2026-89261

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication,

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-11 发布INFO

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes ...

CVE-2026-89260

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wec

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-09-11 发布INFO

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arb...

CVE-2026-89066

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-09-11 发布INFO

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and direct...

CVE-2026-89065

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-d

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-09-11 发布INFO

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints ...

CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-11 发布INFO

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protec...

CVE-2026-89012

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parame

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-09-11 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-85984. Reason: This candidate is a reservation duplicate of CVE-2026-85984. Notes: All CVE u...

CVE-2026-87122

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-85984. Reason: This candidate is a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-11 发布INFO

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-09-11 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Softwa...

CVE-2026-7863

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-11 发布INFO

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newD...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field b

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-09-11 发布INFO

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an a...

CVE-2026-3869

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentia

历史摘要 · 未重新核验 · NVD

#cve #cwe-303

漏洞预警2026-09-11 发布INFO

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpf...

CVE-2026-15439

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-11 发布INFO

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-s...

CVE-2026-8303

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-09-11 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot R...

CVE-2026-8301

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-11 发布INFO

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path v...

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through comma

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-09-11 发布INFO

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted com...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using e

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-09-11 发布INFO

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed po...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using s

历史摘要 · 未重新核验 · NVD

#cve #cwe-228