2026-09-24 归档

今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-22 发布INFO

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringH...

CVE-2026-62985

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-22 发布INFO

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with...

CVE-2026-61570

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-09-22 发布INFO

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-contr...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDI

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-09-22 发布INFO

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-cont...

CVE-2026-58268

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_s

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-09-22 发布INFO

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python scrip...

CVE-2026-95831

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfu

历史摘要 · 未重新核验 · NVD

#cve #cwe-506

漏洞预警2026-09-22 发布INFO

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsCo...

CVE-2026-94462

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/st

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-22 发布INFO

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-char...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-22 发布INFO

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vuln...

CVE-2026-89277

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-22 发布INFO

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails`

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-22 发布INFO

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this ...

CVE-2026-83963

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this ...

CVE-2026-81998

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-22 发布INFO

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value...

CVE-2026-77399

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-834

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandle...

CVE-2026-77272

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destin...

CVE-2026-77269

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are create...

CVE-2026-77268

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequ...

CVE-2026-77266

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, up

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled...

CVE-2026-77262

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server...

CVE-2026-77259

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-552

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller...

CVE-2026-77257

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HT

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and ac...

CVE-2026-77256

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-732