2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-...

CVE-2026-63448

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-401 #cwe-407

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp...

CVE-2026-63447

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspect...

CVE-2026-63446

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-401 #cwe-407

漏洞预警2026-09-18 发布INFO

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-...

CVE-2026-61670

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs s

历史摘要 · 未重新核验 · NVD

#cve #cwe-214

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mi...

CVE-2026-57229

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-665

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable de...

CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/...

CVE-2026-57227

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes...

CVE-2026-57225

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-18 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation...

CVE-2026-57223

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-428

漏洞预警2026-09-18 发布INFO

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms ...

CVE-2026-93873

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-18 发布INFO

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write ...

CVE-2026-93872

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comment

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-18 发布INFO

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store r...

CVE-2026-93871

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-18 发布INFO

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can ...

CVE-2026-93870

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-18 发布INFO

Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-s...

CVE-2026-93869

Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect de

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-18 发布INFO

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million...

CVE-2026-93868

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creati

历史摘要 · 未重新核验 · NVD

#cve #cwe-338

漏洞预警2026-09-18 发布INFO

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds chec...

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-18 发布INFO

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can suppl...

CVE-2026-93840

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-18 发布INFO

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefi...

CVE-2026-93838

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails t

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-18 发布INFO

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, ...

CVE-2026-93031

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-09-18 发布INFO

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneva...

CVE-2026-92708

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-226