2026-09-18 归档

今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application log...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics b

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-09-17 发布INFO

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with ...

CVE-2026-55062

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23 #cwe-36 #cwe-73

漏洞预警2026-09-17 发布INFO

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Spl...

CVE-2026-55061

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-09-17 发布INFO

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail w...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-201

漏洞预警2026-09-17 发布INFO

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.c...

CVE-2026-54571

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-17 发布INFO

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary...

CVE-2026-54524

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be...

CVE-2026-54451

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-17 发布INFO

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled...

CVE-2026-54253

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in pac

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initiali...

CVE-2026-54239

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertex

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-639

漏洞预警2026-09-17 发布INFO

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hiera...

CVE-2026-52852

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups a

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-17 发布INFO

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/p...

CVE-2026-52851

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an ob

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the ...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publica

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-09-17 发布INFO

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial...

CVE-2026-49292

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBV

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code e...

CVE-2026-19477

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). This

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-17 发布INFO

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Performing a manipul...

CVE-2026-92927

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing o

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-09-17 发布INFO

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manip...

CVE-2026-92926

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepar

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-17 发布INFO

Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-contro...

CVE-2026-89038

Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocke...

CVE-2026-54551

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-17 发布INFO

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an ...

CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, netw...

CVE-2026-54446

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensi

历史摘要 · 未重新核验 · NVD

#cve #cwe-306