2026-09-21 归档

今日共收录 815 条安全情报，包含 111 个 CVE，394 篇安全通告，以及 53 篇研究论文。

漏洞预警2026-09-20 发布INFO

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings ...

CVE-2026-93970

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-259 #cwe-798

漏洞预警2026-09-20 发布INFO

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication ...

CVE-2026-86554

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布INFO

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation lea...

CVE-2026-93969

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_sup

历史摘要 · 未重新核验 · NVD

#cve #cwe-259 #cwe-798

漏洞预警2026-09-20 发布INFO

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing...

CVE-2026-93968

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-269

漏洞预警2026-09-20 发布INFO

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component Command...

CVE-2026-93967

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-09-20 发布INFO

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.p...

CVE-2026-93966

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SS

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-09-20 发布INFO

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem...

CVE-2026-92965

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code sup

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-20 发布INFO

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with ...

CVE-2026-92541

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布INFO

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowin...

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users cap

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布INFO

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allo...

CVE-2026-92423

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the req

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-20 发布INFO

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress s...

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-20 发布INFO

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up record...

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up del

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-20 发布INFO

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed t...

CVE-2026-87840

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative boo

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-20 发布INFO

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to u...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-20 发布INFO

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allow...

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a r

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布INFO

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing u...

CVE-2026-87067

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deser

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-20 发布INFO

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data throug...

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-20 发布INFO

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload...

CVE-2026-84223

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, al

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-20 发布INFO

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always re...

CVE-2026-82842

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-20 发布INFO

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing us...

CVE-2026-81654

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-639