2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer comm...

CVE-2026-84682

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adj

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-63724

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-63721

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4...

CVE-2026-55232

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-01 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authent...

CVE-2026-55231

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-han...

CVE-2026-55230

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.

CVE-2026-27872

- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects E

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-01 发布INFO

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.

CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive inform

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-01 发布INFO

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions...

CVE-2026-104059

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows un

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-01 发布INFO

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket...

CVE-2026-104057

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-10-01 发布INFO

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery re...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or i

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-01 发布INFO

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setu...

CVE-2026-9032

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interfa

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-01 发布INFO

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or...

CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-88

漏洞预警2026-10-01 发布INFO

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unaut...

CVE-2026-78578

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setu

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the sam...

CVE-2026-78577

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. Af

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing querie...

CVE-2026-73976

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-01 发布INFO

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength ...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-01 发布INFO

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength l...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-01 发布INFO

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_aut...

CVE-2026-56098

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-10-01 发布INFO

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters us...

CVE-2026-56097

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-89