2026-05-08 归档

今日共收录 1100 条安全情报，包含 294 个 CVE，452 篇安全通告，以及 61 篇研究论文。

漏洞预警2026-05-06 发布INFO

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the or...

CVE-2026-40296

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-06 发布INFO

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasin...

CVE-2026-3291

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-926

漏洞预警2026-05-06 发布INFO

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with ...

CVE-2026-40251

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-05-06 发布INFO

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an a...

CVE-2026-40243

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OV

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-06 发布INFO

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with ...

CVE-2026-40197

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-06 发布INFO

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with ...

CVE-2026-40195

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-06 发布INFO

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the component Response He...

CVE-2026-8033

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-05-06 发布INFO

A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. This manipulation of...

CVE-2026-8032

A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of

历史摘要 · 未重新核验 · NVD

#cve #cwe-259 #cwe-798

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as ...

CVE-2026-44118

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request heade

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by s...

CVE-2026-44117

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips U

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSR...

CVE-2026-44116

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function t

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation...

CVE-2026-44115

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtim...

CVE-2026-44114

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dot

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount r...

CVE-2026-44113

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intende...

CVE-2026-44112

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within the workspac...

CVE-2026-44111

OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-183

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Attackers with DM-pai...

CVE-2026-44110

OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization th

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-ris...

CVE-2026-43584

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment p

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound med...

CVE-2026-43583

OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media re

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebin...

CVE-2026-43582

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-367