2026-09-16 归档

今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily ...

CVE-2026-71047

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily ...

CVE-2026-70915

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are affected are 12.2.3-1...

CVE-2026-70755

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File down

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buff...

CVE-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value...

CVE-2026-69217

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and pa...

CVE-2026-69215

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unan

历史摘要 · 未重新核验 · NVD

#cve #cwe-565 #cwe-1275

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but ...

CVE-2026-69210

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength reje

历史摘要 · 未重新核验 · NVD

#cve #cwe-835 #cwe-1284

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it h...

CVE-2026-69206

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records last

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STR...

CVE-2026-69203

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rat...

CVE-2026-69202

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 a...

CVE-2026-62597

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Mana

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote ...

CVE-2026-61544

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic co

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-15 发布INFO

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.

CVE-2026-51134

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' paramete

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset...

CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to e

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct st...

CVE-2026-32599

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-15 发布INFO

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permi...

CVE-2026-18425

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\Sitem

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share ...

CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a h

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user hol...

CVE-2026-18423

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search p

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Pa...

CVE-2026-18422

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged...

CVE-2026-13327

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier all

历史摘要 · 未重新核验 · NVD

#cve #cwe-295