2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

漏洞预警2026-05-13 发布INFO

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $ta...

CVE-2026-42550

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePd

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied contro...

CVE-2026-42549

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recur

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-13 发布INFO

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body ...

CVE-2026-42548

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query paramet

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-13 发布INFO

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose ac...

CVE-2026-33381

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature ...

CVE-2026-33380

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's fi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or...

CVE-2026-33378

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the s

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

CVE-2026-33377

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have wr

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desi...

CVE-2026-33376

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask expl

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this t...

CVE-2026-28383

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request b

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Any Editor could delete any snapshot, even if they have no access to read or write them.

CVE-2026-28380

Any Editor could delete any snapshot, even if they have no access to read or write them.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This r...

CVE-2026-28379

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concur

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory condition...

CVE-2026-28376

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming req

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

CVE-2026-28374

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution with...

CVE-2026-8496

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar in

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. c...

CVE-2026-8466

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbo

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before...

CVE-2026-44248

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-13 发布INFO

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_sp...

CVE-2026-43970

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit...

CVE-2026-42587

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpConte

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlle...

CVE-2026-42586

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling req...

CVE-2026-42585

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-444