2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-22 发布INFO

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthentic...

CVE-2026-95653

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead

历史摘要 · 未重新核验 · NVD

#cve #cwe-340

漏洞预警2026-09-22 发布INFO

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rp...

CVE-2026-94640

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-22 发布INFO

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to req...

CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can caus

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-346 #cwe-668

漏洞预警2026-09-22 发布INFO

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy acces...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-09-22 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflig...

CVE-2026-88010

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewar

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-22 发布INFO

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate ...

CVE-2026-86805

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-22 发布INFO

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organiz...

CVE-2026-86698

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization me

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-09-22 发布INFO

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL o...

CVE-2026-85055

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission i

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-285

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Window...

CVE-2026-81886

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocatio...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation f

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-835

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_...

CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 byte...

CVE-2026-81883

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecod

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-pr...

CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-170

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swi...

CVE-2026-81881

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-191

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF ...

CVE-2026-81880

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-834

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the...

CVE-2026-81879

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM han

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-22 发布INFO

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython ...

CVE-2026-81878

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecod

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-787

漏洞预警2026-09-22 发布INFO

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in ...

CVE-2026-80150

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB88

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in ...

CVE-2026-80149

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB88

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in ...

CVE-2026-80148

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB88

历史摘要 · 未重新核验 · NVD

#cve #cwe-918