2026-09-20 归档

今日共收录 942 条安全情报，包含 169 个 CVE，438 篇安全通告，以及 68 篇研究论文。

漏洞预警2026-09-20 发布MEDIUM

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an ...

CVE-2026-86552

CVE-2026-86552 涉及 SmartLife 应用的身份认证与注册流程缺陷。该应用在运行时动态生成全新的认证参数，但后端注册接口 /account/person/signup.serv 在注册过程中未验证邮箱所有权。攻击者在获取有

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布HIGH

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/cou...

CVE-2026-93959

CVE-2026-93959 是 SourceCodester Online Reviewer Management System 1.0 中存在的一处 SQL 注入漏洞。该问题位于文件 /reviewer_0/admins/assessm

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-20 发布LOW

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in th...

CVE-2026-86551

该漏洞影响 Z80Ultra (NX741J) 产品，本质是一个本地信息泄露问题。设备在 Android 的 Settings.Secure 数据库中保留了一个只读字段 factory_mac_address，用于存放出厂的 Wi-Fi M

历史摘要 · 未重新核验 · NVD

#cve #cwe-668

漏洞预警2026-09-19 发布MEDIUM

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA p...

CVE-2026-94057

Exim 是广泛部署的开源邮件传输代理（MTA），承担大量互联网与内网邮件的接收、转发与投递。NVD 披露 CVE-2026-94057：4.100.1 之前的 Exim 版本存在「SMTP 走私」（SMTP smuggling）问题。该缺

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-09-19 发布HIGH

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

CVE-2026-94056

该漏洞影响 Exim 邮件传输代理（MTA）4.100.1 之前的所有版本。Exim 支持 PROXY 协议（源自 HAProxy 的 PROXY protocol），用于在邮件服务器位于负载均衡器、反向代理或 TLS 终止设备之后时，由前

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-09-19 发布HIGH

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

CVE-2026-94054

Exim 是广泛使用的邮件传输代理（MTA）。CVE-2026-94054 影响 Exim 4.100.1 之前的版本。当 Exim 配置使用 Proxy-Protocol（PROXY 协议）且其前置代理可被攻击者控制时，攻击者可以通过该代

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-19 发布HIGH

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply ...

CVE-2026-93993

Mistral Vibe 是一款面向开发者的编码/仓库操作工具。在 2.25.5 之前的版本中，其 worktree（工作树）创建流程存在逻辑顺序缺陷：程序在执行「仓库信任验证」（trust validation）之前，就已经运行了 Git

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-09-19 发布HIGH

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the meta...

CVE-2026-93991

Argo Workflows 4.1.0 至 4.1.3 版本在 ListArchivedWorkflows 接口中存在授权绕过漏洞。该接口用于列出已归档的工作流（Archived Workflows），正常情况下应根据调用者的权限对其可访

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-19 发布LOW

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can suppl...

CVE-2026-93989

该漏洞存在于 vLLM 至 0.29.0 版本。vLLM 是当前广泛使用的高吞吐大模型推理与服务框架, 其核心能力是把多个 in-flight 请求打包成批次 (continuous batching) 在同一进程与 GPU 上并行解码,

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-19 发布INFO

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. A...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-19 发布INFO

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component S...

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighl

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-09-19 发布INFO

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/...

CVE-2026-93955

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-19 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-89155

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-19 发布INFO

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/mai...

CVE-2026-93954

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-863

漏洞预警2026-09-19 发布INFO

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict int...

CVE-2026-82672

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-19 发布INFO

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds it...

CVE-2026-82560

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting d

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-19 发布INFO

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly ch...

CVE-2026-94001

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-19 发布INFO

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system f...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue oc

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-19 发布INFO

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when ...

CVE-2026-93999

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-19 发布INFO

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a vol...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin.

历史摘要 · 未重新核验 · NVD

#cve #cwe-73