2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-17 发布INFO

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registrati...

CVE-2026-54907

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-09-17 发布INFO

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff....

CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes

历史摘要 · 未重新核验 · NVD

#cve #cwe-758 #cwe-908

漏洞预警2026-09-17 发布INFO

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/...

CVE-2026-54521

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_request hook in src/...

CVE-2026-54510

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-352

漏洞预警2026-09-17 发布INFO

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslate...

CVE-2026-54354

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter tran

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installati...

CVE-2026-54237

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /instal

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-862

漏洞预警2026-09-17 发布INFO

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_heade...

CVE-2026-50275

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddt

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-17 发布INFO

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonposi...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-123 #cwe-823 #cwe-1284

漏洞预警2026-09-17 发布INFO

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to es...

CVE-2026-15815

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plug

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59 #cwe-94

漏洞预警2026-09-17 发布INFO

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthen...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme G

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might ...

CVE-2026-92943

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for

历史摘要 · 未重新核验 · NVD

#cve #cwe-297

漏洞预警2026-09-17 发布INFO

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure...

CVE-2026-92758

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-17 发布INFO

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may in

历史摘要 · 未重新核验 · NVD

#cve #cwe-311

漏洞预警2026-09-17 发布INFO

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and sche...

CVE-2026-92756

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov

历史摘要 · 未重新核验 · NVD

#cve #cwe-311

漏洞预警2026-09-17 发布INFO

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an e...

CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earli

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-17 发布INFO

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues e...

CVE-2026-54594

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/d

历史摘要 · 未重新核验 · NVD

#cve #cwe-799

漏洞预警2026-09-17 发布INFO

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the open...

CVE-2026-54495

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-668

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes ...

CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.Creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-209 #cwe-441 #cwe-918

漏洞预警2026-09-17 发布INFO

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundl...

CVE-2026-92230

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-401 #cwe-772