2026-09-29 归档

今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-28 发布INFO

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncau...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-550

漏洞预警2026-09-28 发布INFO

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC ...

CVE-2026-101914

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-187 #cwe-863

漏洞预警2026-09-28 发布INFO

A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scor...

CVE-2026-101143

A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-09-28 发布INFO

A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Question...

CVE-2026-101142

A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown function

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manip...

CVE-2026-101141

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-09-28 发布INFO

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descrip...

CVE-2026-97686

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properl

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-09-28 发布INFO

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files ...

CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a maliciou

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-09-28 发布INFO

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTran...

CVE-2026-84894

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a F

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-28 发布INFO

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a c...

CVE-2026-13018

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-28 发布INFO

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its in...

CVE-2026-102010

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, t

历史摘要 · 未重新核验 · NVD

#cve #cwe-825

漏洞预警2026-09-28 发布INFO

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass St...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/in

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profil...

CVE-2026-101132

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. ...

CVE-2026-101131

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-807

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, ec...

CVE-2026-101111

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request pa...

CVE-2026-101110

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) quote() instead of rejecting it.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request paramete...

CVE-2026-101109

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) tag, to be injected into the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parame...

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file /create_profile of the component Pro...

CVE-2026-101105

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprof

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its...

CVE-2026-100753

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) element to execute in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate f...

CVE-2026-100752

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatem

历史摘要 · 未重新核验 · NVD

#cve #cwe-89