2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-22 发布INFO

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attac...

CVE-2026-77544

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi g

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated o...

CVE-2026-93345

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterator

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-09-22 发布INFO

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios...

CVE-2026-84301

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-su...

CVE-2026-56682

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-807

漏洞预警2026-09-22 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the R...

CVE-2026-77637

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") i

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-22 发布INFO

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-...

CVE-2026-56681

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-09-22 发布INFO

In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However,...

CVE-2026-95671

In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-09-22 发布INFO

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers ...

CVE-2026-93342

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-22 发布INFO

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user...

CVE-2026-90882

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-C

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-09-22 发布INFO

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_share...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client c

历史摘要 · 未重新核验 · NVD

#cve #cwe-322

漏洞预警2026-09-22 发布INFO

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up ...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-21 发布INFO

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and perm...

CVE-2026-94536

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-21 发布INFO

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges c...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-09-21 发布INFO

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.

CVE-2026-88467

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of va

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-21 发布INFO

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path...

CVE-2026-77517

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph opera

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-21 发布INFO