2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a deco...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-09-29 发布INFO

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful e...

CVE-2026-65102

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tenso

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-09-29 发布INFO

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index vali...

CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-787

漏洞预警2026-09-29 发布INFO

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this...

CVE-2026-49243

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click o

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi net...

CVE-2026-22101

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive inform

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-29 发布INFO

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.

CVE-2026-22094

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the S

历史摘要 · 未重新核验 · NVD

#cve #cwe-1391

漏洞预警2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescape...

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPD...

CVE-2026-102569

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-29 发布INFO

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as ...

CVE-2026-102568

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-29 发布INFO

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can cr...

CVE-2026-102567

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-29 发布INFO

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craf...

CVE-2026-102566

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-29 发布INFO

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the f...

CVE-2026-102491

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element i

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-29 发布INFO

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with t...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the

历史摘要 · 未重新核验 · NVD

#cve #cwe-214

漏洞预警2026-09-29 发布INFO

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sendin...

CVE-2025-33207

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause imp

历史摘要 · 未重新核验 · NVD

#cve #cwe-1262

漏洞预警2026-09-29 发布INFO

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint t...

CVE-2015-20122

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-29 发布INFO

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata...

CVE-2026-97395

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set Fil

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-29 发布INFO

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Pro...

CVE-2026-86450

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-09-29 发布INFO

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference...

CVE-2026-81569

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-29 发布INFO

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming req...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whethe

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-29 发布INFO

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user...

CVE-2026-71899

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-863