2026-05-06 归档

今日共收录 1285 条安全情报，包含 277 个 CVE，391 篇安全通告，以及 322 篇研究论文。

← 返回归档列表

漏洞预警2026-05-05 发布INFO

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component P...

CVE-2026-7854

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-120

漏洞预警2026-05-05 发布INFO

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of th...

CVE-2026-7853

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.a

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-120

漏洞预警2026-05-05 发布INFO

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perfor...

CVE-2026-7411

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTT

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-05 发布INFO

A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.cgi. Such manipulat...

CVE-2026-7834

A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_white

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-05-05 发布INFO

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessC...

CVE-2026-36356

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-306

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted conte...

CVE-2026-43566

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious h...

CVE-2026-43534

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued a

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-05-05 发布INFO

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to ...

CVE-2023-54344

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-05 发布INFO

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary ...

CVE-2023-54342

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface th

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-05 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC WebinarIgnition allows Blind SQL Injection. This issue aff...

CVE-2026-40797

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC We

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-05 发布INFO

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the a...

CVE-2026-7823

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-05-05 发布INFO

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlle...

CVE-2026-5294

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-05 发布INFO

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the role...

CVE-2025-13618

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-05 发布INFO

The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow...

CVE-2026-5722

The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-05-04 发布INFO

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it...

CVE-2026-42796

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-04 发布INFO

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL inj...

CVE-2026-42087

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-04 发布INFO

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path`...

CVE-2026-42812

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-284 #cwe-732 #cwe-863

漏洞预警2026-05-04 发布INFO

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those crede...

CVE-2026-42811

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, bu

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-917

漏洞预警2026-05-04 发布INFO

Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters a...

CVE-2026-42810

Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access pol

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-116

漏洞预警2026-05-04 发布INFO

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. ...

CVE-2026-42809

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effectiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-862