2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-22 发布INFO

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved addre...

CVE-2026-85740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parse

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values w...

CVE-2026-85725

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwo

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-22 发布INFO

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_route...

CVE-2026-85709

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Py

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-22 发布INFO

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy databa...

CVE-2026-83803

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the reloca

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a cal...

CVE-2026-83603

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-502

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_AN...

CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rr...

CVE-2026-83601

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENS

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-787

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset...

CVE-2026-83600

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART

历史摘要 · 未重新核验 · NVD

#cve #cwe-193 #cwe-400

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websoc...

CVE-2026-83599

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-09-22 发布INFO

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %U...

CVE-2026-83598

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powe

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-427

漏洞预警2026-09-22 发布INFO

Rejected reason: Further research determined the issue results from a dependency.

CVE-2026-76819

Rejected reason: Further research determined the issue results from a dependency.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-22 发布INFO

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime dat...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-22 发布INFO

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when r...

CVE-2026-76804

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loadi

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-22 发布INFO

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a J...

CVE-2026-76803

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-22 发布INFO

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature...

CVE-2026-76802

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading b

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-22 发布INFO

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA c...

CVE-2026-13087

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/x

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a d...

CVE-2026-95806

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-502

漏洞预警2026-09-22 发布INFO

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (wit...

CVE-2026-95805

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action t

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-22 发布INFO

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit seq...

CVE-2026-95655

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-22 发布INFO

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptan...

CVE-2026-95654

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization de

历史摘要 · 未重新核验 · NVD

#cve #cwe-863