2026-09-29 归档

今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside ...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS t...

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because red

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-345 #cwe-918

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key w...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affect

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not Recur...

CVE-2026-102265

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-09-28 发布INFO

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before ...

CVE-2026-102006

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem fa

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-28 发布INFO

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to ...

CVE-2026-102005

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches Va...

CVE-2026-101918

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_k

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a ne...

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affecte

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-28 发布INFO

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized fro...

CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.S...

CVE-2026-101146

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-09-28 发布INFO

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Manag...

CVE-2026-101145

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-90

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This ma...

CVE-2026-101144

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callre

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-09-28 发布INFO

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check ...

CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Us

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was add...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and x...

CVE-2026-100370

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is respons

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-28 发布INFO

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and ret...

CVE-2026-96760

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-28 发布INFO

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by ex...

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured ide

历史摘要 · 未重新核验 · NVD

#cve #cwe-1390

漏洞预警2026-09-28 发布INFO

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_pre...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processi...

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-28 发布INFO

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09

CVE-2026-102004

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-787