Cyber Security Daily Radar

#severity:high

共收录 5373 条相关情报。

← 返回所有主题
安全公告2026-09-23 发布INFO

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-426#severity:high
安全公告2026-09-23 发布INFO

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other acc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-732#severity:high
安全公告2026-09-23 发布INFO

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

CVE-2026-95604

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-862#severity:high
安全公告2026-09-23 发布INFO

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

CVE-2026-77394

## Summary A user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-79#severity:high
安全公告2026-09-23 发布INFO

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

CVE-2026-82407

**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-20#severity:high
安全公告2026-09-23 发布INFO

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

CVE-2026-82409

**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataFo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-116#severity:high
安全公告2026-09-23 发布INFO

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

CVE-2026-82406

**Location:** `core/kapp/market/market.go` — `Buy()` (approx. L281–436)\ **Severity:** High The native marketplace enfo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-841#severity:high
安全公告2026-09-23 发布INFO

Formie: Missing authorization on sent notification resend modal exposes submission PII

CVE-2026-76089

### Impact The control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController:

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#composer#cwe-200#cwe-639#cwe-862#severity:high
安全公告2026-09-23 发布INFO

Jawn: Quadratic parsing effort in AsyncParser

CVE-2026-61814

`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#maven#cwe-400#cwe-407#severity:high
安全公告2026-09-23 发布INFO

Jawn: Uncontrolled nesting depth in JSON parser

CVE-2026-59990

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote atta

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#maven#cwe-770#severity:high
安全公告2026-09-23 发布INFO

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

CVE-2026-82405

### Description The VM built-in function `KleverUpdateAccountPermission` (registered always-active, `creator.go:381-390

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-863#severity:high
安全公告2026-09-23 发布INFO

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

CVE-2026-86065

## Summary The unauthenticated WebSocket endpoint `GET /subscribe` is registered `open: true` by default (`config/node/a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-770#severity:high
安全公告2026-09-23 发布INFO

Klever-Go: /log controls global node logging

CVE-2026-86064

An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, an

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-200#cwe-306#severity:high
安全公告2026-09-23 发布INFO

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

CVE-2026-77601

## Summary An authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` serv

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#rubygems#cwe-78#severity:high
安全公告2026-09-23 发布INFO

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

CVE-2026-61695

### Summary Wire's Swift runtime (`Wire` SPM/CocoaPods product, implemented by `wire-runtime-swift`) did not reject a n

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#swift#cwe-129#severity:high
安全公告2026-09-23 发布INFO

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

CVE-2026-76087

### Impact The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#composer#cwe-639#cwe-862#severity:high
安全公告2026-09-23 发布INFO

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

CVE-2026-76086

### Impact The control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#composer#cwe-862#cwe-915#cwe-918#severity:high
安全公告2026-09-23 发布INFO

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

CVE-2026-77422

### Summary The JLine3 built-in `grep` command wraps the user-supplied regular expression with `.*` before compiling it

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#maven#cwe-1333#severity:high
安全公告2026-09-23 发布INFO

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

CVE-2026-56679

### Summary The `PATCH /api/settings` endpoint writes the entire request body to persistent settings without a field whi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-915#severity:high
安全公告2026-09-23 发布INFO

9router: Image prefetch DNS rebinding allows SSRF to internal services

CVE-2026-56676

## Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-367#cwe-918#severity:high