2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound reque...

CVE-2026-42584

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClien

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up...

CVE-2026-42583

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameD

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3....

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-789

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when ...

CVE-2026-42581

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjec

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request...

CVE-2026-42580

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's c

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-444

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraint...

CVE-2026-42579

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's D

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-400 #cwe-626

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with hea...

CVE-2026-42578

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's H

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that r...

CVE-2026-42577

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll t

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke...

CVE-2026-42032

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke...

CVE-2026-42031

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Rejected reason: REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-40520. Reason: This candidate is a duplicate of CVE-2026-40520. Notes: All CVE users should ref...

CVE-2026-41410

Rejected reason: REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-40520. Reason: This candidate is a dup

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated reque...

CVE-2026-41255

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any cert...

CVE-2026-41132

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-13 发布INFO

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unex...

CVE-2026-33585

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-233

漏洞预警2026-05-13 发布INFO

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. ...

CVE-2026-33584

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-05-13 发布INFO

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the ...

CVE-2026-33583

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via a

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-05-13 发布INFO

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

CVE-2026-30906

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user t

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-05-13 发布INFO

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation...

CVE-2026-30905

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-05-13 发布INFO

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.

CVE-2026-30904

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-05-13 发布INFO

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by i...

CVE-2026-22677

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-22