安全史上的今天（2025-9-24）安全事件列表。
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
【中文导读】Apache IoTDB 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.
【中文导读】该 CVE 涉及安全缺陷（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
【中文导读】Linux kernel 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable.
【中文导读】Linux kernel 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Check encryption key size on incoming connection This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: Security Mode 4 Level 4, Responder - Invalid Encryption Key Size - 128 bit This tests the security key with size from 1 to 15 bytes while the Security Mode 4 Level 4 requests 16 bytes key size. Currently PTS fails with the following logs: - expected:Connection Response: Code: [3 (0x03)] Code Identifier: (lt)WildCard: Exists(gt) Length: [8 (0x0008)] Destination CID: (lt)WildCard: Exists(gt) Source CID: [64 (0x0040)] Result: [3 (0x0003)] Connection refused - Security block Status: (lt)WildCard: Exists(gt), but received:Connection Response: Code: [3 (0x03)] Code Identifier: [1 (0x01)] Length: [8 (0x0008)] Destination CID: [64 (0x0040)] Source CID: [64 (0x0040)] Result: [0 (0x0000)] Connection Successful Status: [0 (0x0000)] No further information available And HCI logs: < HCI Command: Read Encrypti.. (0x05|0x0008) plen 2 Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) > HCI Event: Command Complete (0x0e) plen 7 Read Encryption Key Size (0x05|0x0008) ncmd 1 Status: Success (0x00) Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) Key size: 7 > ACL Data RX: Handle 14 flags 0x02 dlen 12 L2CAP: Connection Request (0x02) ident 1 len 4 PSM: 4097 (0x1001) Source CID: 64 < ACL Data TX: Handle 14 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 1 len 8 Destination CID: 64 Source CID: 64 Result: Connection successful (0x0000) Status: No further information available (0x0000)
【中文导读】该 CVE 涉及权限提升（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used.
【中文导读】pretrain_gpt script 存在信息泄露风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
【中文导读】tasks 存在信息泄露风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】NVIDIA Megatron-LM for all platforms contains a vulnerability in the tasks/orqa/unsupervised/nq.py component, where an attacker may cause a code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker may cause an injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, Information disclosure, and data tampering.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】NVIDIA Megatron-LM for all platforms contains a vulnerability in the ensemble_classifer script where malicious data created by an attacker may cause an injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, Information disclosure, and data tampering.
【中文导读】该 CVE 涉及远程代码执行（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while performing private key encryption in trusted application.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Cryptographic issue while performing RSA PKCS padding decoding.
【中文导读】该 CVE 涉及内存破坏（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
【中文导读】该 CVE 涉及内存破坏（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while selecting the PLMN from SOR failed list.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while processing message in guest VM.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while processing data sent by FE driver.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while handling repeated memory unmap requests from guest VM.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption due to double free when multiple threads race to set the timestamp store.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
【中文导读】该 CVE 涉及拒绝服务（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Transient DOS while parsing the EPTM test control message to get the test pattern.
【中文导读】该 CVE 涉及拒绝服务（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Transient DOS while handling command data during power control processing.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while encoding the image data.
【中文导读】该 CVE 涉及拒绝服务（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Transient DOS while processing power control requests with invalid antenna or stream values.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Memory corruption while handling invalid inputs in application info setup.
【中文导读】该 CVE 涉及安全缺陷（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
【中文导读】Use after free in Dawn in Google Chrome prior to 存在内存破坏、释放后使用风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
【中文导读】该 CVE 涉及内存破坏、释放后使用（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
【中文导读】Type confusion in 存在安全缺陷风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
【中文导读】Side-channel information leakage in 存在信息泄露风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
【中文导读】Integer overflow in 存在整数溢出风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
【中文导读】Integer overflow in 存在整数溢出风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
【中文导读】该 CVE 涉及输入验证（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input. Alternatively, an unauthenticated attacker could persuade a legitimate user with administrative privileges who is currently logged in to the system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
【中文导读】Datart 存在路径遍历风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.
【中文导读】Datart 存在远程代码执行、路径遍历、反序列化风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization. This allows deserialization of attacker-controlled YAML content, leading to arbitrary class instantiation. Under certain conditions, this can be exploited to achieve remote code execution (RCE).
【中文导读】该 CVE 涉及认证绕过（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device.
【中文导读】该 CVE 涉及拒绝服务（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.
【中文导读】Simple Network Management Protocol 存在拒绝服务风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when parsing a specific SNMP request. An attacker could exploit this vulnerability by sending a specific SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.
【中文导读】Network-Based Application Recognition 存在拒绝服务风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could exploit this vulnerability by sending malformed CAPWAP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
【中文导读】该 CVE 涉及拒绝服务、输入验证（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted URL in an HTTP request. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
【中文导读】Simple Network Management Protocol 存在拒绝服务风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Note: This vulnerability affects all versions of SNMP.