2026-09-27 归档

今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。

漏洞预警2026-09-26 发布INFO

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.htm...

CVE-2026-100673

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication ch...

CVE-2026-100672

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that r

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-26 发布INFO

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by...

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Tw

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard tha...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (u...

CVE-2026-100669

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively.

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-09-26 发布INFO

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the n...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated()...

CVE-2026-100667

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challeng

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-09-26 发布INFO

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response w...

CVE-2026-100666

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to a

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-26 发布INFO

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManage...

CVE-2026-100665

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-26 发布INFO

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-strea...

CVE-2026-100662

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled reso

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-26 发布INFO

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (Qpac...

CVE-2026-100661

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-26 发布INFO

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field ...

CVE-2026-100659

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-26 发布INFO

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions q...

CVE-2026-100658

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The han

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-26 发布INFO

Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocat...

CVE-2026-100657

Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declare

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-09-26 发布INFO

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined ...

CVE-2026-100656

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec t

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-26 发布INFO

Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated ...

CVE-2026-100655

Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final a

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-26 发布INFO

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the value...

CVE-2026-100654

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/cha

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-09-26 发布INFO

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-09-26 发布INFO

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinT...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-26 发布INFO

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multim...

CVE-2026-100651

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1

历史摘要 · 未重新核验 · NVD

#cve #cwe-400