2026-09-23 归档

今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。

漏洞预警2026-09-21 发布INFO

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send...

CVE-2026-94622

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for pre

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-21 发布INFO

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-sele...

CVE-2026-94540

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, r

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-21 发布INFO

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Att...

CVE-2026-94535

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-21 发布INFO

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user pro...

CVE-2026-94534

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-21 发布INFO

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can...

CVE-2026-94533

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-21 发布INFO

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. A...

CVE-2026-94532

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-21 发布INFO

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any a...

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-640

漏洞预警2026-09-21 发布INFO

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).

CVE-2026-88756

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitte

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-21 发布INFO

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

CVE-2026-79079

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-21 发布INFO

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioni...

CVE-2026-78806

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-21 发布INFO

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementat...

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-09-21 发布INFO

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeReq...

CVE-2026-61743

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · NVD

#cve #cwe-350

漏洞预警2026-09-21 发布INFO

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses r...

CVE-2026-61652

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issu

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-21 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HT...

CVE-2026-59830

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-cont

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-21 发布INFO

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serv...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-21 发布INFO

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existin...

CVE-2026-55210

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-21 发布INFO

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took...

CVE-2026-17054

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-process

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-21 发布INFO

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/a...

CVE-2026-15890

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead

历史摘要 · 未重新核验 · NVD

#cve #cwe-323 #cwe-362

漏洞预警2026-09-21 发布INFO

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passe...

CVE-2026-94588

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-09-21 发布INFO

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim in...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field

历史摘要 · 未重新核验 · NVD

#cve #cwe-94