2026-09-18 归档

今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to refer...

CVE-2026-69197

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

漏洞预警2026-09-17 发布INFO

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processe...

CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-17 发布INFO

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially...

CVE-2026-56795

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-09-17 发布INFO

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with...

CVE-2026-12284

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a m

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-17 发布INFO

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with ...

CVE-2026-92987

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-09-17 发布INFO

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or cr...

CVE-2026-92986

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files w...

CVE-2026-92985

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim ses...

CVE-2026-92984

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-09-17 发布INFO

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of in...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions bec

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-09-17 发布INFO

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. T...

CVE-2026-92880

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/c

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-787

漏洞预警2026-09-17 发布INFO

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is no...

CVE-2026-88952

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another us

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-17 发布INFO

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster...

CVE-2026-87742

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (D

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-17 发布INFO

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating...

CVE-2026-85078

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-17 发布INFO

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes respon...

CVE-2026-85077

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 respo

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network ac...

CVE-2026-81447

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access cou...

CVE-2026-81446

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could po...

CVE-2026-81445

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker...

CVE-2026-80356

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Un

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-17 发布INFO

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart...

CVE-2026-79752

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in...

CVE-2026-77614

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-384