Chromium CVE-2026-87483: Incorrect authorization in Browser
CVE-2026-87483
微软 MSRC 于 2026 年 9 月 30 日发布 CVE-2026-87483 的漏洞公告，该编号由 Google Chrome 团队分配，属于 Chromium 浏览器内核中的一个“授权不当”（Incorrect authoriza
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
CVE-2026-103758
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP s
Ivanti Endpoint Manager Mobile代码注入漏洞
知道创宇/Seebug 于 2026-10-02 收录了一条标题为“Ivanti Endpoint Manager Mobile 代码注入漏洞”的漏洞条目。当前公开信息仅给出漏洞名称、来源和时间，未提供 CVE 编号、受影响版本、受影响组件
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
知道创宇 / Seebug 漏洞库收录了一条标题为《Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)》的条目，从标题看指向 Fortinet FortiGate 系
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group...
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file...
CVE-2026-51888
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intende
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN...
CVE-2026-102294
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
CVE-2026-73605
### Summary `/api/file/getUniqueFilename` takes a path from the request body and passes it to a filesystem existence ch
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区于2026年10月2日发布了一篇题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》的研究文章。文章标签为 community、xianzhi、research，涉及漏洞编号 CVE-2026-71486
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
CVE-2026-88771 · CVE-2026-88772
Palo Alto Networks Unit 42 于 2026 年 9 月 30 日发布威胁简报（Threat Brief，标注为 9 月 30 日更新版），称其已注意到针对 Citrix NetScaler（NetScaler ADC
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to th...
CVE-2026-19660
WordPress 插件 Divi Membership 在 2.3.0 及之前所有版本中存在身份认证绕过漏洞 (CVE-2026-19660)。该插件的 `process_paypal_callback` 函数被挂载到 WordPress
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
CVE-2026-92948
## Summary On Node.js 24 and newer, `vm2` can expose the host `node:test` module to sandboxed `NodeVM` code when the em
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
CVE-2026-92940
Summary vm2 3.11.6 exposes the host process's real `https.globalAgent` when a `NodeVM` is explicitly allowed to require
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CVE-2026-92951
### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
CVE-2026-92937
## Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js pr
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
CVE-2026-93304
(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
Chromium CVE-2026-87643: Integer overflow in GPU
CVE-2026-87643
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-87640: Out of bounds read in WebView
CVE-2026-87640
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P