2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploade...

CVE-2026-81182

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifie...

CVE-2026-81181

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image pr...

CVE-2026-81180

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Profess

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing...

CVE-2026-81178

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-18 发布INFO

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file v...

CVE-2026-77396

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-787

漏洞预警2026-09-18 发布INFO

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem...

CVE-2026-77385

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-18 发布INFO

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgrad...

CVE-2026-71537

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Se

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-09-18 发布INFO

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS ...

CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布INFO

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assemb...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression poi

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-09-18 发布INFO

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with stan...

CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-18 发布INFO

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply a...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-con...

CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-18 发布INFO

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths au...

CVE-2026-63199

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-18 发布INFO

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds ...

CVE-2026-62279

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTransl...

CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-18 发布INFO

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configurati...

CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-18 发布INFO

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. Th...

CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaus

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-18 发布INFO

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/co...

CVE-2026-33625

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布INFO

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-fi...

CVE-2026-32641

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/ht

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-703

漏洞预警2026-09-18 发布INFO

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a rec...

CVE-2026-93758

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639