2026-09-23 归档

今日共收录 1513 条安全情报,包含 580 个 CVE,548 篇安全通告,以及 93 篇研究论文。

← 返回归档列表
漏洞预警2026-09-21 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the curre...

CVE-2026-73512

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4,

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-21 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client c...

CVE-2026-50572

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4,

历史摘要 · 未重新核验 · NVD

安全公告2026-09-22 发布INFO

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

CVE-2026-62985

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDI

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

mppx: Gas Draining with access list

CVE-2026-63628

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

mppx: Gas Draining with padding

CVE-2026-63627

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-p

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

Home Assistant: mDNS Server-Side Request Forgery

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

Home Assistant: XSS in Statistics Graph Card

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

CVE-2026-57149

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of po

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

CVE-2026-63386

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recurs

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

icalendar: Denial of service via unbounded VALARM REPEAT expansion

CVE-2026-77399

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fro

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

CVE-2026-77256

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

CVE-2026-77249

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

CVE-2026-77259

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

CVE-2026-77247

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

CVE-2026-77269

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

CVE-2026-77266

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, up

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

CVE-2026-77255

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

CVE-2026-77262

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-22 发布INFO

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

CVE-2026-77253

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

历史摘要 · 未重新核验 · OSV.dev