2026-04-30 归档

今日共收录 966 条安全情报，包含 229 个 CVE，399 篇安全通告，以及 34 篇研究论文。

漏洞预警2026-04-29 发布INFO

Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by trigge...

CVE-2018-25303

Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-04-29 发布INFO

Allok AVI to DVD SVCD VCD Converter 4.0.1217 contains a structured exception handling (SEH) based buffer overflow vulnerability that allows local attackers to execute arbitrary ...

CVE-2018-25302

Allok AVI to DVD SVCD VCD Converter 4.0.1217 contains a structured exception handling (SEH) based buffer overflow vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-04-29 发布INFO

Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supply...

CVE-2018-25301

Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-04-29 发布INFO

XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id ...

CVE-2018-25300

XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipula

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-04-29 发布INFO

Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attac...

CVE-2018-25299

Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploit

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-04-29 发布INFO

Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-vie...

CVE-2018-25298

Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-04-29 发布INFO

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter ...

CVE-2026-7466

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline file

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-04-29 发布INFO

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attacker...

CVE-2026-7439

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-04-29 发布INFO

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment,...

CVE-2026-7424

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent netwo

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-04-29 发布INFO

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device c...

CVE-2026-7423

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adj

历史摘要 · 未重新核验 · NVD

#cve #cwe-191

漏洞预警2026-04-29 发布INFO

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the ...

CVE-2026-7422

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-04-29 发布INFO

A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the function Upload of the file bioinfo_...

CVE-2026-7398

A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-04-29 发布INFO

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results...

CVE-2026-7397

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-04-29 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRIT...

CVE-2026-41499

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-124 #cwe-191

漏洞预警2026-04-29 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists i...

CVE-2026-28221

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-121 #cwe-400

漏洞预警2026-04-29 发布INFO

Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker wit...

CVE-2026-27105

Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-04-29 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protect...

CVE-2026-26206

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-362 #cwe-367

漏洞预警2026-04-29 发布INFO

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of th...

CVE-2026-7394

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unkn

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-04-29 发布INFO

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role with...

CVE-2026-5712

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assi

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-04-29 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occur...

CVE-2026-26204

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-124 #cwe-191