2026-05-12 归档

今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。

漏洞预警2026-05-11 发布INFO

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component. When the s...

CVE-2026-31251

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging ...

CVE-2026-31250

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its make_parquet_list.py data process...

CVE-2026-31249

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromst...

CVE-2026-31248

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and val

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

A security vulnerability has been detected in Open5GS up to 2.7.7. The affected element is the function yuarel_parse in the library /lib/sbi/conv.c of the component NRF. Such ma...

CVE-2026-8292

A security vulnerability has been detected in Open5GS up to 2.7.7. The affected element is the function yuarel_parse in

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-05-11 发布INFO

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the component NRF. This mani...

CVE-2026-8291

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-05-11 发布INFO

Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Sec...

CVE-2026-7820

Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS o

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-05-11 发布INFO

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, ...

CVE-2026-7819

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath,

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-05-11 发布INFO

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents (using Python's...

CVE-2026-7818

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-11 发布INFO

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-supplied api_key_file and api_url preferenc...

CVE-2026-7817

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration end

历史摘要 · 未重新核验 · NVD

#cve #cwe-552

漏洞预警2026-05-11 发布INFO

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template withou...

CVE-2026-7816

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolat

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-11 发布INFO

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were c...

CVE-2026-7815

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_p

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-11 发布INFO

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, colu...

CVE-2026-7814

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controll

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrativ...

CVE-2026-6815

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path s

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.

CVE-2026-6093

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose record

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-11 发布INFO

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that...

CVE-2026-44643

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an att

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-05-11 发布INFO

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections...

CVE-2026-44201

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and I

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-05-11 发布INFO

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have ac...

CVE-2026-44200

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with lim

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-05-11 发布INFO

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to for...

CVE-2026-44199

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with lim

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-05-11 发布INFO

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history...

CVE-2026-44198

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without

历史摘要 · 未重新核验 · NVD

#cve #cwe-280