2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the...

CVE-2026-75806

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-09-29 发布INFO

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted ...

CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL po

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-29 发布INFO

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-29 发布INFO

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an intern...

CVE-2026-72897

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-29 发布INFO

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary:...

CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key o

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-29 发布INFO

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending ...

CVE-2026-54873

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summar

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-29 发布INFO

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks informa...

CVE-2026-54872

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-29 发布INFO

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity propor...

CVE-2026-42772

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out o

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-09-29 发布INFO

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit compu...

CVE-2026-35191

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incomi

历史摘要 · 未重新核验 · NVD

#cve #cwe-440

漏洞预警2026-09-29 发布INFO

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary:...

CVE-2026-35189

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap grow

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-09-29 发布INFO

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with l...

CVE-2026-19743

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-29 发布INFO

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to in...

CVE-2026-102630

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-09-29 发布INFO

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across ada...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/W

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-09-29 发布INFO

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up atta...

CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-eng

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-1321

漏洞预警2026-09-29 发布INFO

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_jo...

CVE-2026-102598

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_direc

历史摘要 · 未重新核验 · NVD

#cve #cwe-67

漏洞预警2026-09-29 发布INFO

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system co...

CVE-2026-100308

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep

历史摘要 · 未重新核验 · NVD

#cve #cwe-470 #cwe-502

漏洞预警2026-09-29 发布INFO

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external id...

CVE-2026-100288

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-09-29 发布INFO

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vau...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-29 发布INFO

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secret...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-29 发布INFO

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88