2026-09-24 归档

今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-23 发布INFO

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers...

CVE-2026-75799

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-23 发布INFO

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a mani...

CVE-2026-96257

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-09-22 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic l...

CVE-2026-18169

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

CVE-2026-18163

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-22 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input with...

CVE-2026-18162

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-22 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.

CVE-2026-17645

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevate

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-22 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based sec...

CVE-2026-17635

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-22 发布INFO

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

CVE-2026-17472

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources d

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-22 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in ...

CVE-2026-16346

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands du

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-22 发布INFO

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on...

CVE-2026-89282

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissio

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-09-22 发布INFO

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

CVE-2026-87121

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthentica...

CVE-2026-76709

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful explo

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-22 发布INFO

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administr...

CVE-2026-76708

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-09-22 发布INFO

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with diction...

CVE-2026-47116

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-09-22 发布INFO

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could e...

CVE-2026-82000

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result i

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-22 发布INFO

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An...

CVE-2026-81995

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identi...

CVE-2026-77254

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, re

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-22 发布INFO

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, pote...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-22 发布INFO

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution ...

CVE-2026-75682

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-89