2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read ...

CVE-2026-58415

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server befor

历史摘要 · 未重新核验 · NVD

#cve #cwe-552

漏洞预警2026-10-01 发布INFO

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVE-2026-56449

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issu

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-01 发布INFO

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVE-2026-56153

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-01 发布INFO

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause...

CVE-2026-48005

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all p

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting...

CVE-2026-21833

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configure

历史摘要 · 未重新核验 · NVD

#cve #cwe-1032

漏洞预警2026-10-01 发布INFO

The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When spr...

CVE-2026-14316

The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buff

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-01 发布INFO

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass...

CVE-2026-13043

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-798

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is proces...

CVE-2026-12544

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a v

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-sup...

CVE-2026-12541

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system comma...

CVE-2026-12540

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The req

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb....

CVE-2026-12423

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-01 发布INFO

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has th...

CVE-2026-12405

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS cer...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-leg

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-01 发布INFO

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unes...

CVE-2026-101890

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a...

CVE-2026-101889

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the ...

CVE-2026-101888

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application...

CVE-2025-31980

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-01 发布INFO

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or pass...

CVE-2026-9864

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account

历史摘要 · 未重新核验 · NVD

#cve #cwe-338

漏洞预警2026-10-01 发布INFO

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's ass...

CVE-2026-94620

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-01 发布INFO

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malfor...

CVE-2026-79896

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portm

历史摘要 · 未重新核验 · NVD

#cve #cwe-125