2026-05-12 归档

今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。

漏洞预警2026-05-11 发布INFO

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend do...

CVE-2026-43887

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section perm

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested O...

CVE-2026-43886

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call p...

CVE-2026-43885

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read API

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSS...

CVE-2026-43884

WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsyn

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacke...

CVE-2026-43883

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.jso

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled titl...

CVE-2026-43882

WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of regist...

CVE-2026-43881

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two u

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitt...

CVE-2026-43880

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes t

历史摘要 · 未重新核验 · NVD

#cve #cwe-940

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at i...

CVE-2026-43879

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescape...

CVE-2026-43878

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the at

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST param...

CVE-2026-43877

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legac

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into se...

CVE-2026-43876

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oau...

CVE-2026-43875

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php comp

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->my...

CVE-2026-43873

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.ph

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-05-11 发布INFO

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultip...

CVE-2026-42600

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-11 发布INFO

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename...

CVE-2026-42564

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200

漏洞预警2026-05-11 发布INFO

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling...

CVE-2026-42188

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-11 发布INFO

libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a contr...

CVE-2026-42046

libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-190 #cwe-787

漏洞预警2026-05-11 发布INFO

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity i...

CVE-2026-34961

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing val

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-05-11 发布INFO

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options p...

CVE-2026-34960

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_m

历史摘要 · 未重新核验 · NVD

#cve #cwe-125