Cyber Security Daily Radar

2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

← 返回归档列表
漏洞预警2026-09-18 发布INFO

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Perf...

CVE-2026-93505

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-

历史摘要 · 未重新核验 · NVD

#cve#cwe-79#cwe-94
漏洞预警2026-09-18 发布INFO

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due ...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oau

历史摘要 · 未重新核验 · NVD

#cve#cwe-290
漏洞预警2026-09-18 发布INFO

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image ma...

CVE-2026-77929

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote c

历史摘要 · 未重新核验 · NVD

#cve#cwe-434
漏洞预警2026-09-18 发布INFO

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id para...

CVE-2026-77928

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · NVD

#cve#cwe-89
漏洞预警2026-09-18 发布INFO

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_...

CVE-2026-77927

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · NVD

#cve#cwe-89
漏洞预警2026-09-18 发布INFO

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.

CVE-2026-25684

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluatio

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-09-18 发布INFO

net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). ...

CVE-2026-16515

net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rul

历史摘要 · 未重新核验 · NVD

#cve#cwe-406
漏洞预警2026-09-18 发布INFO

gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against t...

CVE-2026-16514

gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS

历史摘要 · 未重新核验 · NVD

#cve#cwe-125
漏洞预警2026-09-18 发布INFO

gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that the rec...

CVE-2026-16512

gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched

历史摘要 · 未重新核验 · NVD

#cve#cwe-125
漏洞预警2026-09-18 发布INFO

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Di...

CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaus

历史摘要 · 未重新核验 · NVD

#cve#cwe-770
漏洞预警2026-09-18 发布INFO

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ...

CVE-2025-1350

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitiv

历史摘要 · 未重新核验 · NVD

#cve#cwe-209
漏洞预警2026-09-18 发布INFO

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2....

CVE-2025-13882

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM

历史摘要 · 未重新核验 · NVD

#cve#cwe-799
漏洞预警2026-09-18 发布INFO

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly en...

CVE-2024-56344

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain se

历史摘要 · 未重新核验 · NVD

#cve#cwe-327
漏洞预警2026-09-18 发布INFO

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: [...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allow

历史摘要 · 未重新核验 · NVD

#cve#cwe-284
漏洞预警2026-09-18 发布INFO

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingD...

CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares onl

历史摘要 · 未重新核验 · NVD

#cve#cwe-299
漏洞预警2026-09-18 发布INFO

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for...

CVE-2026-93601

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorr

历史摘要 · 未重新核验 · NVD

#cve#cwe-295
漏洞预警2026-09-18 发布INFO

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing ...

CVE-2026-93600

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore

历史摘要 · 未重新核验 · NVD

#cve#cwe-295
漏洞预警2026-09-18 发布INFO

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to rejec...

CVE-2026-93599

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_str

历史摘要 · 未重新核验 · NVD

#cve#cwe-191
漏洞预警2026-09-18 发布INFO

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLooku...

CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot s

历史摘要 · 未重新核验 · NVD

#cve#cwe-184
漏洞预警2026-09-18 发布INFO

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs...

CVE-2026-93597

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and

历史摘要 · 未重新核验 · NVD

#cve#cwe-918