2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

安全公告2026-09-22 发布INFO

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii

CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-407

安全公告2026-09-22 发布INFO

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1286

安全公告2026-09-22 发布INFO

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode

CVE-2026-87079

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-407

安全公告2026-09-22 发布INFO

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode

CVE-2026-87078

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_pu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-401

安全公告2026-09-22 发布INFO

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

CVE-2026-74766

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that r

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-416

安全公告2026-09-22 发布INFO

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode

CVE-2026-74765

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumula

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-125 #cwe-190

安全公告2026-09-22 发布INFO

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-22 发布INFO

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-113

安全公告2026-09-22 发布INFO

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-460

安全公告2026-09-22 发布INFO

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-41

安全公告2026-09-22 发布INFO

CVE-2026-37604

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/

历史摘要 · 未重新核验 · OSV.dev

#advisory

安全公告2026-09-22 发布INFO

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Soc

历史摘要 · 未重新核验 · OSV.dev

#advisory

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

CVE-2026-94627

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child reque

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-401

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

CVE-2026-94626

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-789

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

CVE-2026-94625

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests cr

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-772

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

CVE-2026-94624

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configur

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

CVE-2026-94623

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation tha

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-617

安全公告2026-09-21 发布INFO

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

CVE-2026-94622

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for pre

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-248

安全公告2026-09-21 发布INFO

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

安全公告2026-09-21 发布INFO

Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-640