2026-09-24 归档

今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-23 发布INFO

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns ...

CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer p

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-23 发布INFO

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommand...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-23 发布INFO

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term f...

CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-23 发布INFO

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jl...

CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(Str

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-23 发布INFO

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with syste...

CVE-2026-77394

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-23 发布INFO

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output ...

CVE-2026-77285

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-09-23 发布INFO

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) ex...

CVE-2026-76648

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs n

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotification...

CVE-2026-76089

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639 #cwe-862

漏洞预警2026-09-23 发布INFO

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a ...

CVE-2026-76087

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-23 发布INFO

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFor...

CVE-2026-76086

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-915 #cwe-918

漏洞预警2026-09-23 发布INFO

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit b...

CVE-2026-71465

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-09-23 发布INFO

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Sched...

CVE-2026-71464

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-09-23 发布INFO

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} condit...

CVE-2026-71463

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-23 发布INFO

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary ...

CVE-2026-71462

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths.

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-09-23 发布INFO

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking compl...

CVE-2026-71461

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-23 发布INFO

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) re...

CVE-2026-71460

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authen...

CVE-2026-71459

JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions()

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leav...

CVE-2026-71458

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-09-23 发布INFO

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recove...

CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-23 发布INFO

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specifi...

CVE-2026-63131

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could

历史摘要 · 未重新核验 · NVD

#cve #cwe-863