2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-02 发布CRITICAL

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary p...

CVE-2026-103764

该漏洞位于 Mooncake 传输引擎 (transfer engine) 0.3.13 之前的版本中,具体缺陷点是服务端会话处理函数 ServerSession::readHeader。Mooncake 是面向大模型推理场景的高性能数据传

历史摘要 · 未重新核验 · NVD

#cve #cwe-822

漏洞预警2026-10-01 发布INFO

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-C...

CVE-2026-56662

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-01 发布INFO

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads...

CVE-2026-56660

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-434 #cwe-918

漏洞预警2026-10-01 发布INFO

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed wit...

CVE-2026-53953

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-338 #cwe-640

漏洞预警2026-10-01 发布INFO

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated at...

CVE-2026-102628

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in

历史摘要 · 未重新核验 · NVD

#cve #cwe-215 #cwe-489

漏洞预警2026-10-01 发布INFO

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 t...

CVE-2026-55083

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-01 发布INFO

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-441

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting request...

CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause

历史摘要 · 未重新核验 · NVD

#cve #cwe-267

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating...

CVE-2026-96658

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-10-01 发布INFO

Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 thr...

CVE-2026-59797

Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-01 发布INFO

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVE-2026-57941

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affec

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-01 发布INFO

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVE-2026-56154

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue a

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-01 发布INFO

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregis...

CVE-2026-12627

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregister

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-10-01 发布INFO

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

CVE-2026-62071

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-01 发布INFO

Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

CVE-2026-103752

Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-10-01 发布INFO

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence see...

CVE-2026-79901

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-accoun

历史摘要 · 未重新核验 · NVD

#cve #cwe-338

漏洞预警2026-10-01 发布INFO

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to...

CVE-2026-103264

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is ...

CVE-2026-103255

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-01 发布INFO

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that ...

CVE-2026-103248

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-89