2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized us...

CVE-2026-90913

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-29 发布INFO

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check ...

CVE-2026-90907

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8,

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-29 发布INFO

Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.

CVE-2026-90906

Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL I...

CVE-2026-102796

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundati

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-29 发布INFO

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse sh...

CVE-2026-102697

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bas

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-29 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview...

CVE-2026-102676

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-1188

漏洞预警2026-09-29 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served thr...

CVE-2026-102675

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-29 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from ...

CVE-2026-102674

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-693

漏洞预警2026-09-29 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed ifra...

CVE-2026-102673

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-693

漏洞预警2026-09-29 发布INFO

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can...

CVE-2026-102635

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's app

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-09-29 发布INFO

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenti...

CVE-2026-102634

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /genera

历史摘要 · 未重新核验 · NVD

#cve #cwe-694

漏洞预警2026-09-29 发布INFO

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supply...

CVE-2026-102633

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit pl

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-29 发布INFO

A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machin...

CVE-2026-102623

A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-29 发布INFO

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the under...

CVE-2026-102557

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequate

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-29 发布INFO

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal i...

CVE-2026-102556

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs ...

CVE-2026-102425

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-...

CVE-2026-102424

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments i

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension ...

CVE-2026-101127

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs a...

CVE-2026-101126

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission process

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and del...

CVE-2026-101112

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpA

历史摘要 · 未重新核验 · NVD

#cve #cwe-639