Alert for CVE-2022-21500
CVE-2022-21500
Alert for CVE-2022-21500
2026-05-05 归档
今日共收录 918 条安全情报，包含 208 个 CVE，383 篇安全通告，以及 47 篇研究论文。
← 返回归档列表Alert for CVE-2021-44228
CVE-2021-44228
Alert for CVE-2021-44228
Linux 内核提权 CVE-2026-31431(copy-fail)
CVE-2026-31431
Linux 内核提权 CVE-2026-31431(copy-fail)
【安全通告】Linux Kernel 本地权限提升漏洞风险通告（CVE-2026-31431）
CVE-2026-31431
【安全通告】Linux Kernel 本地权限提升漏洞风险通告（CVE-2026-31431）
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
## Summary `OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments.
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
### Impact All versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file u
SCRIBE: Practical Static Binary Patching via Binary-Aware Recompilation of Decompiled Code
该论文提出了一种名为SCRIBE的实用静态二进制补丁框架，旨在解决在没有源代码或原始工具链时，通过解编译后重编译进行二进制补丁的困难。现有解编译器（如Hex-Rays）输出的代码存在大量语法和语义不准确，导致重编译失败或补丁不正确。SCRI
Obscura: Privacy-Preserving Protocol for the Algorand Blockchain Using LSAG Ring Signatures
本文提出 Obscura，一种针对 Algorand 区块链的隐私保护协议。现有区块链隐私方案（如以太坊上的 zk-SNARKs）在高吞吐量链（如 Algorand）上难以实现，因为存在严格的每调用执行预算和全局 Merkle 累加器引起的
InsureConnect: Blockchain and Digital Identity for the Property Insurance Market
本文提出 InsureConnect，一个基于区块链的财产保险市场系统，旨在改善自然灾害后保险工作流程中的透明度、认证和可审计性。系统结合了自我主权身份（SSI）、去中心化标识符（DIDs）、可验证凭证（VCs）、卫星图像、Hyperled
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthen...
CVE-2026-41927
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firew
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insuffic...
CVE-2026-41926
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cg
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to ...
CVE-2026-41923
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cg
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthent...
CVE-2026-41471
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerabili
3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the context of the root u...
CVE-2025-13605
3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to exec
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user...
CVE-2026-6266
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation ...
CVE-2025-58074
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse
CVE-2026-20929
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse
Weaver E-cology critical bug exploited in attacks since March
CVE-2026-22679
Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mi
The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the role...
CVE-2025-13618
WordPress Mentoring插件（所有版本至1.2.8）存在权限提升漏洞。该漏洞源于插件在mentoring_process_registration()函数中未正确限制用户注册时可选择的角色，导致未认证攻击者能够注册并获取管理员
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow...
CVE-2026-5722
MoreConvert Pro 是一款 WordPress 插件，其访客等待列表验证流程存在严重身份认证绕过漏洞（CVE-2026-5722），影响所有版本（含 1.9.14 及之前版本）。漏洞根因是当客户电子邮件地址更改时，验证令牌未失效