2026-10-02 归档

今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-01 发布INFO

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacke...

CVE-2026-76147

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent u

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-807 #cwe-862

漏洞预警2026-10-01 发布INFO

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely

CVE-2026-76146

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-01 发布INFO

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by mani...

CVE-2026-76145

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator p

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-01 发布INFO

An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that i...

CVE-2026-76144

An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-10-01 发布INFO

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by mani

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal ...

CVE-2026-76142

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-306

漏洞预警2026-10-01 发布INFO

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability ...

CVE-2026-12241

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized mod

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/Inst...

CVE-2026-103539

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-01 发布INFO

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/superma...

CVE-2026-103538

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderControlle

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-01 发布INFO

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/superma...

CVE-2026-103536

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderContro

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-01 发布INFO

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is d...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' paramet...

CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-01 发布INFO

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' ...

CVE-2026-91109

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-01 发布INFO

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header...

CVE-2026-103641

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanl

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-01 发布INFO

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/...

CVE-2026-103533

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-01 发布INFO

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent ...

CVE-2026-101887

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a

历史摘要 · 未重新核验 · NVD

#cve #cwe-369

漏洞预警2026-10-01 发布INFO

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary me

历史摘要 · 未重新核验 · NVD

#cve #cwe-665

漏洞预警2026-10-01 发布INFO

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared L...

CVE-2026-103532

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-285

漏洞预警2026-09-30 发布INFO

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated adm...

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values ...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79