2026-09-18 归档

今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-17 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-33626. Reason: This candidate is a duplicate of CVE-2026-33626. Notes: All CVE users should ...

CVE-2025-62167

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-33626. Reason: This candidate is a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-17 发布INFO

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-17 发布INFO

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthen...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme G

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-17 发布INFO

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go o...

CVE-2026-92993

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-17 发布INFO

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might ...

CVE-2026-92943

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for

历史摘要 · 未重新核验 · NVD

#cve #cwe-297

漏洞预警2026-09-17 发布INFO

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure...

CVE-2026-92758

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-17 发布INFO

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may in

历史摘要 · 未重新核验 · NVD

#cve #cwe-311

漏洞预警2026-09-17 发布INFO

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and sche...

CVE-2026-92756

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov

历史摘要 · 未重新核验 · NVD

#cve #cwe-311

漏洞预警2026-09-17 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-57846

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-17 发布INFO

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an e...

CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earli

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-17 发布INFO

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail...

CVE-2026-54692

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

历史摘要 · 未重新核验 · NVD

#cve #cwe-131 #cwe-787

漏洞预警2026-09-17 发布INFO

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues e...

CVE-2026-54594

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/d

历史摘要 · 未重新核验 · NVD

#cve #cwe-799

漏洞预警2026-09-17 发布INFO

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the open...

CVE-2026-54495

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-668

漏洞预警2026-09-17 发布INFO

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without a...

CVE-2026-50285

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-1284

漏洞预警2026-09-17 发布INFO

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated g...

CVE-2026-50125

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets ...

CVE-2026-45726

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a st

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522 #cwe-732

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes ...

CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.Creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-209 #cwe-441 #cwe-918

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go check...

CVE-2026-45720

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.

历史摘要 · 未重新核验 · NVD

#cve #cwe-294 #cwe-367

漏洞预警2026-09-17 发布INFO

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the compone...

CVE-2026-92992

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-09-17 发布INFO

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundl...

CVE-2026-92230

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-401 #cwe-772