2026-05-12 归档

今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。

漏洞预警2026-05-11 发布INFO

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitiz...

CVE-2026-42887

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobooksh...

CVE-2026-42886

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload endpoint dec

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-05-11 发布INFO

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved ...

CVE-2026-42885

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-11 发布INFO

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all librar...

CVE-2026-42884

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/col

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-11 发布INFO

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the ...

CVE-2026-42883

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-11 发布INFO

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission...

CVE-2026-42876

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-11 发布INFO

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resourc...

CVE-2026-42875

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-668

漏洞预警2026-05-11 发布INFO

Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the p...

CVE-2026-42874

Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-05-11 发布INFO

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php,...

CVE-2026-42873

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with m

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to im...

CVE-2026-42872

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) v

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/pr...

CVE-2026-42870

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due ...

CVE-2026-42565

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirec

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-05-11 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-21 and 6.9.13-46, a malicious MIFF file could trigger an overflow w...

CVE-2026-42050

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-21 and 6.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-05-11 发布INFO

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionalit...

CVE-2026-36734

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can su

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to ...

CVE-2026-2614

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-11 发布INFO

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has k...

CVE-2022-4988

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains versi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba. Affected by this vulnerability is the function toc_transformer of the ...

CVE-2026-8318

A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba. Affected by t

历史摘要 · 未重新核验 · NVD

#cve #cwe-404 #cwe-835

漏洞预警2026-05-11 发布INFO

Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accept...

CVE-2026-7790

Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. T

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-11 发布INFO

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that res...

CVE-2026-45224

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-11 发布INFO

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payload...

CVE-2026-45223

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path whe

历史摘要 · 未重新核验 · NVD

#cve #cwe-290