2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-01 发布INFO

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52.

CVE-2026-27873

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affec

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-01 发布INFO

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues...

CVE-2026-18397

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination

历史摘要 · 未重新核验 · NVD

#cve #cwe-130 #cwe-252 #cwe-347 #cwe-457

漏洞预警2026-10-01 发布INFO

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code a...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the no

历史摘要 · 未重新核验 · NVD

#cve #cwe-338

漏洞预警2026-10-01 发布INFO

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling t...

CVE-2026-104051

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-01 发布INFO

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application int...

CVE-2026-104002

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actor

历史摘要 · 未重新核验 · NVD

#cve #cwe-390

漏洞预警2026-10-01 发布INFO

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitesp...

CVE-2026-96780

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text(

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-10-01 发布INFO

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63.

CVE-2026-71451

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects Eas

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9...

CVE-2026-55396

Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-01 发布INFO

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and ...

CVE-2026-55395

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLoo

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-01 发布INFO

Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traf...

CVE-2026-55394

Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-10-01 发布INFO

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read confi...

CVE-2026-55393

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before...

CVE-2026-27874

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-c

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-10-01 发布INFO

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with ...

CVE-2026-104183

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-10-01 发布INFO

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.j...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-01 发布INFO

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management action...

CVE-2026-104181

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a...

CVE-2026-104020

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor t

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-01 发布INFO

Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker w...

CVE-2026-102514

Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea co

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-01 发布INFO

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are phy...

CVE-2026-102370

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do no

历史摘要 · 未重新核验 · NVD

#cve #cwe-1191

漏洞预警2026-10-01 发布INFO

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps.

CVE-2026-93832

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of r

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write p...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src

历史摘要 · 未重新核验 · NVD

#cve #cwe-863