2026-09-29 归档

今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing ...

CVE-2026-101053

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-09-28 发布INFO

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the...

CVE-2026-101052

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of

历史摘要 · 未重新核验 · NVD

#cve #cwe-259 #cwe-798

漏洞预警2026-09-28 发布INFO

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/...

CVE-2026-91006

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JV

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an ...

CVE-2026-81867

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration version

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-28 发布INFO

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated ...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 202

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

漏洞预警2026-09-28 发布INFO

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authen...

CVE-2026-19759

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prio

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authe...

CVE-2026-12269

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the H

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-434

漏洞预警2026-09-28 发布INFO

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

CVE-2026-12268

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT recor

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-28 发布INFO

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

CVE-2026-12267

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-D...

CVE-2026-101040

A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affec

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-09-28 发布INFO

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login nam...

CVE-2026-90979

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-09-28 发布INFO

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrato...

CVE-2026-7172

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/ind...

CVE-2026-7171

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endpoint '/administra...

CVE-2026-7170

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-28 发布INFO

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The ma...

CVE-2026-101036

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.joi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-28 发布INFO

A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a...

CVE-2026-101035

A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library sr

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the co...

CVE-2026-101018

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-28 发布INFO

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.

CVE-2026-95104

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-09-28 发布INFO

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-1050

漏洞预警2026-09-28 发布INFO

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

CVE-2026-94286

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to c

历史摘要 · 未重新核验 · NVD

#cve #cwe-126