2026-05-12 归档

今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。

← 返回归档列表

漏洞预警2026-05-11 发布INFO

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the ...

CVE-2026-44197

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into re...

CVE-2026-42841

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary ...

CVE-2026-42612

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/g

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can ...

CVE-2026-42611

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox rest...

CVE-2026-42610

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.upda

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permission...

CVE-2026-42609

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-285 #cwe-639 #cwe-837

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as ...

CVE-2026-42608

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash c

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-11 发布INFO

Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoin...

CVE-2026-3320

Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoin...

CVE-2026-3319

Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/S...

CVE-2026-34092

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34091

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.

CVE-2026-34090

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.

CVE-2026-34089

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-11 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34088

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34087

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-11 发布INFO

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34086

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-05-11 发布INFO

Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution...

CVE-2026-31247

Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project exec...

CVE-2026-31246

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted url.

CVE-2025-65418

docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-11 发布INFO

docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application.

CVE-2025-65417

docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page

历史摘要 · 未重新核验 · NVD

#cve #cwe-79