2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-28 发布INFO

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the ...

CVE-2026-102276

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-674

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import p...

CVE-2026-102275

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in j

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-348

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RS...

CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain

历史摘要 · 未重新核验 · NVD

#cve #cwe-755

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-le...

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does ...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This o...

CVE-2026-102270

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because l

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside ...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key w...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affect

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-28 发布INFO

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before ...

CVE-2026-102006

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem fa

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-28 发布INFO

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to ...

CVE-2026-102005

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches Va...

CVE-2026-101918

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_k

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-09-28 发布INFO

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.S...

CVE-2026-101146

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-09-28 发布INFO

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Manag...

CVE-2026-101145

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-90

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This ma...

CVE-2026-101144

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callre

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-284

漏洞预警2026-09-28 发布INFO

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check ...

CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Us

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was add...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by ex...

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured ide

历史摘要 · 未重新核验 · NVD

#cve #cwe-1390

漏洞预警2026-09-28 发布INFO

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_pre...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processi...

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-09-28 发布INFO

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09

CVE-2026-102004

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-787