2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.

CVE-2026-64893

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middl

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-01 发布INFO

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3...

CVE-2026-64892

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resour

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-01 发布INFO

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or com...

CVE-2026-51897

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-sess...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the expos

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized c...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-ac...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-s

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and rea...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path acce

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

CVE-2026-51892

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:valida...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The componen

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside th...

CVE-2026-51882

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen ...

CVE-2026-51881

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote cal

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edi...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface,

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwri...

CVE-2026-51879

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain ...

CVE-2026-51878

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regen

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to s...

CVE-2026-51876

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unau

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspa...

CVE-2026-51875

In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows atta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.

CVE-2026-51874

In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows atta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.

CVE-2026-51873

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to w

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63.

CVE-2026-34494

- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Loc

历史摘要 · 未重新核验 · NVD

#cve #cwe-1191

漏洞预警2026-10-01 发布INFO

- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63.

CVE-2026-34493

- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-1191