2026-09-28 归档

今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。

漏洞预警2026-09-27 发布INFO

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plug...

CVE-2026-101061

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incompl

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-27 发布INFO

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP...

CVE-2026-101060

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-27 发布INFO

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoint...

CVE-2026-101059

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-27 发布INFO

python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that ...

CVE-2026-101058

python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manu

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-27 发布INFO

utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensure_...

CVE-2026-101057

utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a cal

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-09-27 发布INFO

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can repl...

CVE-2026-101056

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-27 发布INFO

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination direc...

CVE-2026-101051

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-27 发布INFO

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.W...

CVE-2026-101048

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-27 发布INFO

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited U...

CVE-2026-101047

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enter

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-27 发布INFO

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprec...

CVE-2026-101046

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-27 发布INFO

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped th...

CVE-2026-101045

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests gen

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-27 发布INFO

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken fr...

CVE-2026-101044

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-27 发布INFO

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a proj...

CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-09-27 发布INFO

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthe...

CVE-2026-101050

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-27 发布INFO

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forge...

CVE-2026-101049

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-27 发布INFO

Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, I...

CVE-2026-101042

Parse Server is an open-source backend server. In versions >= 9.0.0 = 8.0.2 < 8.6.91, the code-based authentication adap

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-27 发布INFO

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumptio...

CVE-2026-101041

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-362

漏洞预警2026-09-27 发布INFO

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs f...

CVE-2026-101033

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-27 发布INFO

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted fil...

CVE-2026-101032

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-27 发布INFO

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthent...

CVE-2026-100870

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r

历史摘要 · 未重新核验 · NVD

#cve #cwe-640