2026-09-17 归档

今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-16 发布INFO

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be u...

CVE-2026-73459

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially c

历史摘要 · 未重新核验 · NVD

#cve #cwe-354

漏洞预警2026-09-16 发布INFO

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that...

CVE-2026-73446

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-09-16 发布INFO

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

CVE-2026-15640

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-16 发布INFO

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

CVE-2026-15639

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScrip

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-16 发布INFO

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is n...

CVE-2026-15638

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using on

历史摘要 · 未重新核验 · NVD

#cve #cwe-327

漏洞预警2026-09-15 发布INFO

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user...

CVE-2025-11395

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create

历史摘要 · 未重新核验 · NVD

#cve #cwe-277

漏洞预警2026-09-15 发布INFO

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overf...

CVE-2026-92259

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the by

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-15 发布INFO

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs duri...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photos

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-15 发布INFO

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts o...

CVE-2026-92114

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 1...

CVE-2026-83408

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The suppo

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is a...

CVE-2026-83368

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-15 发布INFO

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 1...

CVE-2026-83357

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The suppo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fie...

CVE-2026-76873

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_stat...

CVE-2026-76872

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL man

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can ...

CVE-2026-76870

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation ro

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by sub...

CVE-2026-76869

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper ssc

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send requests...

CVE-2026-76868

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-15 发布INFO

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, r...

CVE-2026-76867

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os...

CVE-2026-76866

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNS

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to unchecked...

CVE-2026-76865

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filt

历史摘要 · 未重新核验 · NVD

#cve #cwe-476