2026-09-17 归档

今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rat...

CVE-2026-69202

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 a...

CVE-2026-62597

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Mana

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-15 发布INFO

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.

CVE-2026-51134

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' paramete

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct st...

CVE-2026-32599

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-15 发布INFO

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permi...

CVE-2026-18425

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\Sitem

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share ...

CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a h

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user hol...

CVE-2026-18423

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search p

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Pa...

CVE-2026-18422

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged...

CVE-2026-13327

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier all

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-15 发布INFO

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to ...

CVE-2026-92180

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-09-15 发布INFO

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

CVE-2026-92179

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-15 发布INFO

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i...

CVE-2026-92178

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-09-15 发布INFO

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

CVE-2026-92177

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-15 发布INFO

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal...

CVE-2026-92176

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remo

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-15 发布INFO

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other u...

CVE-2026-90971

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier all

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-15 发布INFO

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtai...

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-15 发布INFO

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positione...

CVE-2026-84850

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolution

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-15 发布INFO

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1 - The TUS endpoint allows arbitrary file uploads, h...

CVE-2026-84048

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery <

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal...

CVE-2026-82191

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2,

历史摘要 · 未重新核验 · NVD

#cve #cwe-1241

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` ca...

CVE-2026-82190

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-1241