2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-22 发布INFO

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with a digit, the integer digit-scan loop ...

CVE-2026-88344

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers sche

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configurat...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of exter...

CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vu

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFIm...

CVE-2026-88339

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). T

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approve...

CVE-2026-83805

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkf

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-22 发布INFO

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permission ca...

CVE-2026-83801

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-22 发布INFO

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admissi...

CVE-2026-79767

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, al...

CVE-2026-77322

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploi...

CVE-2026-76717

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive inf

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-22 发布INFO

Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could e...

CVE-2026-76716

Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or deni

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-22 发布INFO

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnera...

CVE-2026-76715

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-midd

历史摘要 · 未重新核验 · NVD

#cve #cwe-300

漏洞预警2026-09-22 发布INFO

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could...

CVE-2026-76714

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary co

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticate...

CVE-2026-76713

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful explo

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote...

CVE-2026-76712

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information di

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-22 发布INFO

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote...

CVE-2026-76711

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly process

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote atta...

CVE-2026-76710

A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components

CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::Po

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX...

CVE-2026-65829

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_lis...

CVE-2026-63628

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-22 发布INFO

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored...

CVE-2026-63627

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-p

历史摘要 · 未重新核验 · NVD

#cve #cwe-20