2026-09-18 归档

今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_exe...

CVE-2026-71538

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Win

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-17 发布INFO

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with call...

CVE-2026-63461

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and fac

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-17 发布INFO

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking patt...

CVE-2026-63460

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-17 发布INFO

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-compone...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults secu...

CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-441 #cwe-749 #cwe-918 #cwe-1188

漏洞预警2026-09-17 发布INFO

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote a...

CVE-2026-54471

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileg

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-09-17 发布INFO

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could p...

CVE-2026-26950

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-17 发布INFO

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers control...

CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the ...

CVE-2026-92972

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefi

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-17 发布INFO

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the infer...

CVE-2026-92971

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-09-17 发布INFO

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the...

CVE-2026-92970

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state o...

CVE-2026-92963

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL gl

历史摘要 · 未重新核验 · NVD

#cve #cwe-227

漏洞预警2026-09-17 发布INFO

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its ou...

CVE-2026-92962

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepare

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attacke...

CVE-2026-92961

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not avail...

CVE-2026-92959

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.the

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*'...

CVE-2026-92958

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard toge

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-17 发布INFO

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked ...

CVE-2026-92954

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises retu

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-17 发布INFO

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cr...

CVE-2026-92952

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary.

历史摘要 · 未重新核验 · NVD

#cve #cwe-669

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a mal...

CVE-2026-92950

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary cod

历史摘要 · 未重新核验 · NVD

#cve #cwe-453

漏洞预警2026-09-17 发布INFO

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly...

CVE-2026-92949

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-471