2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) l...

CVE-2026-82340

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled refl

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-81657

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allo...

CVE-2026-80442

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCert

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sq...

CVE-2026-80441

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the ge

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text valu...

CVE-2026-61781

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_tim

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-269

漏洞预警2026-09-18 发布INFO

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose cha...

CVE-2026-58264

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth com

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-09-18 发布INFO

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without s...

CVE-2023-54399

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categorie

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory q...

CVE-2026-93762

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-09-18 发布INFO

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested T...

CVE-2026-92702

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-18 发布INFO

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-ses...

CVE-2026-92701

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-354

漏洞预警2026-09-18 发布INFO

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trus...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-18 发布INFO

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disag...

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-18 发布INFO

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated...

CVE-2026-93765

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. In

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-09-18 发布INFO

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who ...

CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insu

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-09-18 发布INFO

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a d...

CVE-2026-81321

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker w

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-09-18 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make Hei...

CVE-2026-84383

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-18 发布INFO

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick qu

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-18 发布INFO

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove ...

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-302 #cwe-348

漏洞预警2026-09-18 发布INFO

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer under...

CVE-2026-10858

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or pote

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-09-18 发布INFO

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing be...

CVE-2026-10747

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-122