2026-09-24 归档

今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-23 发布INFO

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. ...

CVE-2026-19888

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-23 发布INFO

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can sup...

CVE-2026-96675

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate spar

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-23 发布INFO

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers ...

CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-23 发布INFO

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path...

CVE-2026-96673

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-23 发布INFO

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.cal...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values refere

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-09-23 发布INFO

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admi...

CVE-2026-93769

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-23 发布INFO

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in secur...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into execut

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-23 发布INFO

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with owne...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/contro

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-23 发布INFO

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership ...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller e

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-23 发布INFO

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVE-2026-6327

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutra

历史摘要 · 未重新核验 · NVD

#cve #cwe-117

漏洞预警2026-09-23 发布INFO

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This inf...

CVE-2026-4921

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed tec

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-23 发布INFO

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informatio...

CVE-2026-3626

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java...

CVE-2026-19267

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rul

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a...

CVE-2026-19179

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database querie

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management.

CVE-2026-19087

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb....

CVE-2026-18875

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attac...

CVE-2026-18505

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules ...

CVE-2026-18490

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authen...

CVE-2026-18185

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive informati

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-23 发布INFO

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

CVE-2026-18184

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive informati

历史摘要 · 未重新核验 · NVD

#cve #cwe-611