2026-05-08 归档

今日共收录 1100 条安全情报，包含 294 个 CVE，452 篇安全通告，以及 61 篇研究论文。

漏洞预警2026-05-07 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reins...

CVE-2026-41658

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces author

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-07 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), requiring only...

CVE-2026-41657

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-07 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type ...

CVE-2026-41656

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-07 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe fil...

CVE-2026-41655

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-07 发布INFO

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the co...

CVE-2026-41640

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-07 发布INFO

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before ver...

CVE-2026-41587

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-05-07 发布INFO

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Th...

CVE-2026-41203

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-07 发布INFO

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Ba...

CVE-2026-41202

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-07 发布INFO

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3....

CVE-2026-41142

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-05-07 发布INFO

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1....

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-05-07 发布INFO

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TO...

CVE-2026-41002

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git reposi

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-05-07 发布INFO

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended ...

CVE-2026-40981

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the co

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-07 发布INFO

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.

CVE-2026-40004

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execut

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-05-07 发布INFO

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed authorization logi...

CVE-2026-4807

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-07 发布INFO

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.

CVE-2026-44600

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-202

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-05-07 发布INFO

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

CVE-2026-44599

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

历史摘要 · 未重新核验 · NVD

#cve #cwe-669

漏洞预警2026-05-07 发布INFO

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Formina...

CVE-2026-6222

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-07 发布INFO

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode...

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the l

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-05-06 发布INFO

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The con...

CVE-2026-41417

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created f

历史摘要 · 未重新核验 · NVD

#cve #cwe-93 #cwe-444

漏洞预警2026-05-06 发布INFO

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key grow...

CVE-2026-41310

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770