2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by ch...

CVE-2026-73638

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-17 发布INFO

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in ...

CVE-2026-54671

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource arra

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_P...

CVE-2026-54648

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABL...

CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, an...

CVE-2026-54644

CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note ...

CVE-2026-54643

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.ph

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw...

CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld

历史摘要 · 未重新核验 · NVD

#cve #cwe-787 #cwe-908

漏洞预警2026-09-17 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor...

CVE-2026-54612

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94

漏洞预警2026-09-17 发布INFO

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in bac...

CVE-2026-54520

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/ed...

CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path ha...

CVE-2026-54343

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/c...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo throu...

CVE-2026-53555

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated upl

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/ap...

CVE-2026-53554

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-17 发布INFO

yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/ca...

CVE-2026-50158

yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-09-17 发布INFO

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer...

CVE-2026-16750

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of da

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. Th...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modificatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verificat...

CVE-2026-14311

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-17 发布INFO

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function ...

CVE-2026-93395

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when proc

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-09-17 发布INFO

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was...

CVE-2026-93394

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and

历史摘要 · 未重新核验 · NVD

#cve #cwe-303