2026-09-16 归档

今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-15 发布INFO

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview...

CVE-2026-18110

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can...

CVE-2026-91992

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused acr

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-15 发布INFO

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keywo...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-09-15 发布INFO

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can s...

CVE-2026-91990

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart da

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-15 发布INFO

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory...

CVE-2026-91989

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog ...

CVE-2026-91988

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-09-15 发布INFO

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attack...

CVE-2026-91987

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-15 发布INFO

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attack...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task positi...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task'

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited...

CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints w...

CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settin

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-09-15 发布INFO

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users ...

CVE-2026-91981

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-15 发布INFO

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitr...

CVE-2026-91980

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files t...

CVE-2026-91979

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial o

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue...

CVE-2026-91973

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiti

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-09-15 发布INFO

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote un...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, re

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-09-15 发布INFO

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to e...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-15 发布INFO

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authentica...

CVE-2026-91970

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce a

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-15 发布INFO

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenti...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-15 发布INFO

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limit...

CVE-2026-91968

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deepl

历史摘要 · 未重新核验 · NVD

#cve #cwe-674