2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of ...

CVE-2026-101858

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-29 发布INFO

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escapin...

CVE-2026-102374

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that doub

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticke...

CVE-2026-102372

GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthe

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc...

CVE-2026-101281

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function op

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-29 发布INFO

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. Th...

CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290

漏洞预警2026-09-29 发布INFO

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the c...

CVE-2026-101279

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown func

历史摘要 · 未重新核验 · NVD

#cve #cwe-189 #cwe-190

漏洞预警2026-09-29 发布INFO

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the com...

CVE-2026-101278

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-346

漏洞预警2026-09-29 发布INFO

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt-...

CVE-2026-18747

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and t

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-191

漏洞预警2026-09-29 发布INFO

parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it cal...

CVE-2026-18746

parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-09-29 发布INFO

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-stat...

CVE-2026-18417

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's vo

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-09-29 发布INFO

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Dis...

CVE-2026-102367

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-09-29 发布INFO

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validati...

CVE-2026-102366

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorizatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-09-29 发布INFO

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. ...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-29 发布INFO

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracki...

CVE-2026-102363

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-29 发布INFO

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product revi...

CVE-2026-102362

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Un

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-09-29 发布INFO

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c of the component Ta...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-09-29 发布INFO

A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusio...

CVE-2026-101265

A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the c

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-540

漏洞预警2026-09-28 发布INFO

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx dire...

CVE-2026-102335

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin use

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. At...

CVE-2026-102334

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-09-28 发布INFO

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by http...

CVE-2026-102333

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web

历史摘要 · 未重新核验 · NVD

#cve #cwe-79