2026-09-29 归档

今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-28 发布INFO

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authe...

CVE-2026-82928

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential

历史摘要 · 未重新核验 · NVD

#cve #cwe-1242

漏洞预警2026-09-28 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting H...

CVE-2026-82326

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue af...

CVE-2026-82323

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-28 发布INFO

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to repl...

CVE-2026-59563

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target res

历史摘要 · 未重新核验 · NVD

#cve #cwe-305

漏洞预警2026-09-28 发布INFO

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request.

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-28 发布INFO

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-28 发布INFO

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz)....

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getF

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-09-28 发布INFO

A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the component Ex...

CVE-2026-101069

A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/s

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component C...

CVE-2026-101068

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packag

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file...

CVE-2026-101067

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archiv...

CVE-2026-101066

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packag

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of...

CVE-2026-101055

A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-09-28 发布INFO

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermedi...

CVE-2026-94194

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-28 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection...

CVE-2026-92103

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-28 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial o...

CVE-2026-91043

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-28 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agent...

CVE-2026-87752

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Informati

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal...

CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the ...

CVE-2026-19444

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When cop

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.

CVE-2026-12264

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config syn

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-09-28 发布INFO

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Service. The manipul...

CVE-2026-101054

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284