2026-05-05 归档

今日共收录 918 条安全情报，包含 208 个 CVE，383 篇安全通告，以及 47 篇研究论文。

漏洞预警2026-05-05 发布MEDIUM

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode ...

CVE-2026-5247

CVE-2026-5247 影响 WordPress 插件 PublishPress Future（原名 Schedule Post Changes），版本 <=4.10.0。该插件通过 [futureaction] 短代码提供计划发布功能

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-05 发布MEDIUM

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorit...

CVE-2026-4409

CVE-2026-4409 影响 WordPress 插件 Subscribe To Comments Reloaded 所有版本（含 240119）。该漏洞源于插件泄露了一个全局密钥，并使用了弱哈希生成算法。攻击者无需认证即可从任意公开文

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-05 发布MEDIUM

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versi...

CVE-2026-2868

CVE-2026-2868 是 WordPress 插件 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem（版本 ≤ 3.5.3）中的一个存储型跨站脚本（Stored

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-05 发布MEDIUM

The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the `fsReference` AJAX route. This is due to the `findSou...

CVE-2026-1921

Loco Translate 是 WordPress 的一个翻译插件，用于管理翻译文件。在版本 2.8.2 及之前的所有版本中，该插件存在路径遍历漏洞。漏洞位于 `fsReference` AJAX 路由中，因为 `findSourceFi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-05 发布INFO

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanba...

CVE-2026-7783

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::appl

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-05-04 发布INFO

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Te...

CVE-2026-7782

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-05-04 发布INFO

A security vulnerability has been detected in Open5GS up to 2.7.7. Affected by this issue is the function udm_nudm_uecm_handle_amf_registration_update of the file /src/udm/nudm-...

CVE-2026-7781

A security vulnerability has been detected in Open5GS up to 2.7.7. Affected by this issue is the function udm_nudm_uecm_

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-05-04 发布INFO

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin ...

CVE-2026-7791

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpace

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-05-04 发布INFO

A weakness has been identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function udm_state_operational of the file /src/udm/udm-sm.c of the component smf-re...

CVE-2026-7780

A weakness has been identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function udm_state_operatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-05-04 发布INFO

Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with n...

CVE-2026-7776

Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-04 发布INFO

A security flaw has been discovered in Open5GS up to 2.7.7. Affected is the function udm_nudr_dr_handle_subscription_authentication of the file /src/udm/nudr-handler.c of the co...

CVE-2026-7779

A security flaw has been discovered in Open5GS up to 2.7.7. Affected is the function udm_nudr_dr_handle_subscription_aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-05-04 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthentica...

CVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore end

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-04 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs t...

CVE-2026-42223

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/sett

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-04 发布INFO

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window expo...

CVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exist

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-306

漏洞预警2026-05-04 发布INFO

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator ac...

CVE-2026-42221

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-04 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, ...

CVE-2026-42220

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-05-04 发布INFO

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could...

CVE-2026-7768

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-04 发布INFO

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated lik...

CVE-2026-6321

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize()

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-04 发布INFO

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated re...

CVE-2026-41925

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi bin

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-04 发布INFO

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers ...

CVE-2026-41924

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest

历史摘要 · 未重新核验 · NVD

#cve #cwe-78