iOS 16.7.12 and iPadOS 16.7.12
iOS 16.7.12 and iPadOS 16.7.12
2026-05-09 归档
今日共收录 1190 条安全情报，包含 490 个 CVE，393 篇安全通告，以及 21 篇研究论文。
← 返回归档列表iOS 15.8.5 and iPadOS 15.8.5
iOS 15.8.5 and iPadOS 15.8.5
iOS 18.6.2 and iPadOS 18.6.2
iOS 18.6.2 and iPadOS 18.6.2
Android Code Search
Android Code Search
Android Devices
Android Devices
Secure an Android device
Secure an Android device
Android 16 QPR2
Android 16 QPR2
Mobile network security
Mobile network security
MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
Dev Channel Update for ChromeOS / ChromeOS Flex
The ChromeOS Dev channel is being updated to OS version 16667.5.0 (Browser version 149.0.7827.4) for most ChromeOS devic
Chrome Beta for Android Update
Hi everyone! We've just released Chrome Beta 149 (149.0.7827.5) for Android. It's now available on Google Play.You can s
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 150 (150.0.7828.3) for Android. It's now available on Google Play.You can se
Mistune Heading ID Attribute has Injection XSS
CVE-2026-44897
## Summary `HTMLRenderer.heading()` builds the opening `` tag by string-concatenating the `id` attribute value directly
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
CVE-2026-44895
## SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations
Mistune Math Plugin has an XSS Escape Bypass
CVE-2026-44708
## Summary The mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw use
Snipe-IT has insecure permissions in file uploads
CVE-2026-37709
Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a995
free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
CVE-2026-44329
### Summary free5GC's SMF mounts the `UPI` management route group without OAuth2/bearer-token authorization middleware.
free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
CVE-2026-44328
### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
CVE-2026-44324
### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs