MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
2026-05-01 归档
今日共收录 1019 条安全情报，包含 232 个 CVE，445 篇安全通告，以及 40 篇研究论文。
← 返回归档列表MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
MFSA 2026-09Security Vulnerabilities fixed in Firefox for iOS 147.2.1
MFSA 2026-09Security Vulnerabilities fixed in Firefox for iOS 147.2.1
Chrome Beta for iOS Update
Hi everyone! We've just released Chrome Beta 148 (148.0.7778.101) for iOS; it'll become available on App Store in the ne
Chrome Stable for iOS Update
Hi everyone! We've just released Chrome Stable 148 (148.0.7778.100) for iOS; it'll become available on App Store in the
Chrome for Android Update
Hello Everyone! We've just released Chrome 148 (148.0.7778.96) for Android to a small percentage of users. It'll become
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 149 (149.0.7815.0) for Android. It's now available on Google Play.You can se
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the...
CVE-2026-7538
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The...
CVE-2026-7546
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the functi
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
CVE-2026-42137
### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or l
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
CVE-2026-42191
### Summary The OTLP disk retry feature in `OpenTelemetry.Exporter.OpenTelemetryProtocol` silently fell back to `Path.G
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows...
CVE-2026-36760
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary...
CVE-2022-50993
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows...
CVE-2026-36767
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary f
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation...
CVE-2026-4670
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Byp
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
CVE-2026-42449
### Impact In the SDK embedder path (`N8NDocumentationMCPServer` constructor, `getN8nApiClient()`, and `validateInstanc
Weblate Doesn't Invalidate API Token on Password Change
CVE-2026-41519
### Impact When a user changes their password, browser sessions are correctly invalidated via `cycle_session_keys()`, bu
Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
CVE-2026-40281
## Vulnerability Details **CWE**: CWE-20 - Improper Input Validation The metadata value sanitization introduced in v8.
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL
CVE-2026-39383
# CVE Report — Unauthenticated SSRF via Unfiltered Webhook URL in Gotenberg ## Severity | Field | Value
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
CVE-2026-42353
### Summary Versions of `i18next-http-middleware` prior to 3.9.3 pass the user-controlled `lng` and `ns` values from `g