2026-09-17 归档

今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the or...

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-472 #cwe-602

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_fil...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation featu

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-15 发布INFO

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF tok...

CVE-2026-81923

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and...

CVE-2026-81922

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token ...

CVE-2026-81921

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, w

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-15 发布INFO

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configure...

CVE-2026-81920

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The rese

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-15 发布INFO

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). ...

CVE-2026-81919

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::getFilePath()` built...

CVE-2026-81568

Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind...

CVE-2026-81567

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged request ridi...

CVE-2026-78081

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-15 发布INFO

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) ser...

CVE-2026-73467

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal A

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-15 发布INFO

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard d...

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-15 发布INFO

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-sta...

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear tex

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-15 发布INFO

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the ...

CVE-2026-73451

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Vi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that ...

CVE-2026-69214

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a

历史摘要 · 未重新核验 · NVD

#cve #cwe-384 #cwe-565

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When th...

CVE-2026-69213

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames t

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect ...

CVE-2026-69212

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-319

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values...

CVE-2026-69211

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-inf

历史摘要 · 未重新核验 · NVD

#cve #cwe-113 #cwe-1286

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulat...

CVE-2026-69209

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbo

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce ...

CVE-2026-69208

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-401