2026-09-18 归档

今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attack...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the si...

CVE-2026-92942

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-17 发布INFO

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source t...

CVE-2026-92936

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting.

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-17 发布INFO

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}...

CVE-2026-92933

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code `util.getCallSites()`,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-17 发布INFO

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource cons...

CVE-2026-92879

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-404

漏洞预警2026-09-17 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

CVE-2026-90986

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

CVE-2026-90887

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource...

CVE-2026-86533

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a r

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-09-17 发布INFO

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a passw...

CVE-2026-86522

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-117

漏洞预警2026-09-17 发布INFO

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmatio...

CVE-2026-85500

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-305

漏洞预警2026-09-17 发布INFO

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token a...

CVE-2026-82761

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker hol

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-17 发布INFO

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment i...

CVE-2026-82760

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-09-17 发布INFO

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit...

CVE-2026-82759

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audi

历史摘要 · 未重新核验 · NVD

#cve #cwe-760

漏洞预警2026-09-17 发布INFO

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The a...

CVE-2026-82723

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of us

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-17 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email a...

CVE-2026-82685

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-17 发布INFO

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key prov...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to ...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone ab

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low...

CVE-2026-81453

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Res

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could...

CVE-2026-81443

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could pot...

CVE-2026-81442

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-269