2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XS...

CVE-2026-100245

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawi...

CVE-2026-100244

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-29 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS...

CVE-2026-100243

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Al...

CVE-2026-100242

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundati

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-29 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki ...

CVE-2026-100241

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-29 发布INFO

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue af...

CVE-2026-100240

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-29 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. ...

CVE-2026-100238

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell comman...

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by se...

CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the st...

CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.st

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-29 发布INFO

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder re...

CVE-2026-97688

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-09-29 发布INFO

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mod...

CVE-2026-97687

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-440

漏洞预警2026-09-29 发布INFO

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delet...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-29 发布INFO

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploitin...

CVE-2026-92371

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-09-29 发布INFO

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to by...

CVE-2026-92370

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-29 发布INFO

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replac...

CVE-2026-92369

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollb

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-09-29 发布INFO

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A s...

CVE-2026-92368

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerabili

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-09-29 发布INFO

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack ca...

CVE-2026-84784

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-29 发布INFO

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. ...

CVE-2026-84783

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-29 发布INFO

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signi...

CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channe

历史摘要 · 未重新核验 · NVD

#cve #cwe-208