2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-22 发布INFO

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify ta...

CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace me

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-22 发布INFO

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringH...

CVE-2026-62985

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-22 发布INFO

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with...

CVE-2026-61570

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-09-22 发布INFO

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-contr...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDI

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-09-22 发布INFO

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-cont...

CVE-2026-58268

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_s

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-09-22 发布INFO

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the ...

CVE-2026-28325

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-22 发布INFO

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python scrip...

CVE-2026-95831

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfu

历史摘要 · 未重新核验 · NVD

#cve #cwe-506

漏洞预警2026-09-22 发布INFO

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsCo...

CVE-2026-94462

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/st

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-22 发布INFO

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-char...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-22 发布INFO

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp....

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vuln...

CVE-2026-89277

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-22 发布INFO

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails`

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).

CVE-2026-88414

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/ver

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to c...

CVE-2026-84396

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-22 发布INFO

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Expl...

CVE-2026-84395

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to...

CVE-2026-83964

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-22 发布INFO

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this ...

CVE-2026-83963

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...

CVE-2026-83962

Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code exe

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-22 发布INFO

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges ...

CVE-2026-81999

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result i

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this ...

CVE-2026-81998

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution

历史摘要 · 未重新核验 · NVD

#cve #cwe-787