2026-09-16 归档

今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-15 发布INFO

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to...

CVE-2026-91944

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the for

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without ...

CVE-2026-91943

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers ca...

CVE-2026-91942

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns u

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attacke...

CVE-2026-91941

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-15 发布INFO

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted config...

CVE-2026-91940

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_unt

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attack...

CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can sub...

CVE-2026-91937

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run bl...

CVE-2026-91936

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_di

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:cre...

CVE-2026-91935

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary...

CVE-2026-91934

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite datab

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other wor...

CVE-2026-91933

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd par...

CVE-2026-91932

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package...

CVE-2026-91931

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization I...

CVE-2026-91930

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowi

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise...

CVE-2026-91929

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resour

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avat...

CVE-2026-91849

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /in

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-09-15 发布INFO

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson....

CVE-2026-91848

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-15 发布INFO

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced red...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject a

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-15 发布INFO

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML ...

CVE-2026-88621

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.p

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required ...

CVE-2026-88620

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/query

历史摘要 · 未重新核验 · NVD

#cve