2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-18 发布INFO

An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86...

CVE-2026-13666

An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Man

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-09-18 发布INFO

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allo...

CVE-2026-13635

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-09-18 发布INFO

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7...

CVE-2026-13623

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Sy

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. Thi...

CVE-2025-13533

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminat...

CVE-2026-93494

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending

历史摘要 · 未重新核验 · NVD

#cve #cwe-1035

漏洞预警2026-09-18 发布INFO

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) respon...

CVE-2026-93493

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by prov

历史摘要 · 未重新核验 · NVD

#cve #cwe-299

漏洞预警2026-09-18 发布INFO

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 du...

CVE-2026-92622

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in...

CVE-2026-92554

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflecte

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insuffic...

CVE-2026-92249

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and includ...

CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count...

CVE-2026-89059

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-09-18 发布INFO

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin respon...

CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Ori

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-18 发布INFO

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 ...

CVE-2026-85705

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up t...

CVE-2026-85652

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injectio

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and ...

CVE-2026-75961

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could t...

CVE-2026-75157

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `E

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a vi...

CVE-2026-67103

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administ...

CVE-2026-67102

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-18 发布INFO

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all ve...

CVE-2026-18442

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injecti

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including,...

CVE-2026-17607

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89