2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-18 发布INFO

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without bindin...

CVE-2026-93595

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-18 发布INFO

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-executio...

CVE-2026-93594

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control ru

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-18 发布INFO

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types d...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver b

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-18 发布INFO

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints,

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-18 发布INFO

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without es...

CVE-2026-93591

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers c...

CVE-2026-93590

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy chec

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布INFO

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divid...

CVE-2026-93589

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for t

历史摘要 · 未重新核验 · NVD

#cve #cwe-369

漏洞预警2026-09-18 发布INFO

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point durin...

CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder re

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-18 发布INFO

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option i...

CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CU

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布INFO

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitat...

CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, cau

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-18 发布INFO

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This in...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-l

历史摘要 · 未重新核验 · NVD

#cve #cwe-1035

漏洞预警2026-09-18 发布INFO

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. ...

CVE-2026-93504

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+se

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-09-18 发布INFO

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette i...

CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes pas

历史摘要 · 未重新核验 · NVD

#cve #cwe-193 #cwe-908

漏洞预警2026-09-18 发布INFO

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the ...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the us

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-18 发布INFO

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

CVE-2026-88622

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-09-18 发布INFO

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; publi...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HT...

CVE-2026-62282

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack int

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-18 发布INFO

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freela...

CVE-2023-5778

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Control

历史摘要 · 未重新核验 · NVD

#cve #cwe-130

漏洞预警2026-09-18 发布INFO

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the Hp...

CVE-2026-93492

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-1035

漏洞预警2026-09-18 发布INFO

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withhol...

CVE-2026-93491

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipeli

历史摘要 · 未重新核验 · NVD

#cve #cwe-770