2026-09-28 归档

今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。

漏洞预警2026-09-27 发布INFO

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent net...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si

历史摘要 · 未重新核验 · NVD

#cve #cwe-1327

漏洞预警2026-09-27 发布INFO

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC e...

CVE-2026-100867

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-09-27 发布INFO

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers ca...

CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-09-27 发布INFO

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link w...

CVE-2026-97165

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-601

漏洞预警2026-09-27 发布INFO

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.pr...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-27 发布INFO

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days...

CVE-2026-100749

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-27 发布INFO

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

CVE-2026-100748

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-27 发布INFO

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event ...

CVE-2026-100747

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-27 发布INFO

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA...

CVE-2026-93302

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-27 发布INFO

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or...

CVE-2026-89136

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited s

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-27 发布INFO

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (nat...

CVE-2026-89135

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-27 发布INFO

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was...

CVE-2026-89134

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-27 发布INFO

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an uncons...

CVE-2026-89133

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly e

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-27 发布INFO

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wo...

CVE-2026-89102

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response s

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-27 发布INFO

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an...

CVE-2026-15442

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-27 发布INFO

Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-glo...

CVE-2026-94419

Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-27 发布INFO

Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but...

CVE-2026-94418

Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-27 发布INFO

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow user...

CVE-2026-97319

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-27 发布INFO

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alo...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership chec

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-27 发布INFO

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it int...

CVE-2026-96899

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one o

历史摘要 · 未重新核验 · NVD

#cve #cwe-79