2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

漏洞预警2026-05-13 发布INFO

A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allo...

CVE-2026-2695

A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premi

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-05-13 发布INFO

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the AP_InertialSensor...

CVE-2024-48519

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attack

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different p...

CVE-2026-8367

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-13 发布INFO

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access...

CVE-2026-6282

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-13 发布INFO

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary comma...

CVE-2026-6281

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-13 发布INFO

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON des...

CVE-2026-45740

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recu

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-05-13 发布INFO

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where ...

CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-05-13 发布INFO

Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but di...

CVE-2026-45028

Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and inte

历史摘要 · 未重新核验 · NVD

#cve #cwe-323

漏洞预警2026-05-13 发布INFO

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into ...

CVE-2026-44665

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process ent

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-05-13 发布INFO

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This s...

CVE-2026-44664

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-05-13 发布INFO

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal...

CVE-2026-44572

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an exte

历史摘要 · 未重新核验 · NVD

#cve #cwe-349

漏洞预警2026-05-13 发布INFO

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-det...

CVE-2026-44479

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI ru

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-532

漏洞预警2026-05-13 发布INFO

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Cla...

CVE-2026-44470

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-269

漏洞预警2026-05-13 发布INFO

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH ...

CVE-2026-44467

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side

历史摘要 · 未重新核验 · NVD

#cve #cwe-297 #cwe-322

漏洞预警2026-05-13 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in ho...

CVE-2026-44459

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validat

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-05-13 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not f...

CVE-2026-44458

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-116

漏洞预警2026-05-13 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-use...

CVE-2026-44457

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware

历史摘要 · 未重新核验 · NVD

#cve #cwe-524

漏洞预警2026-05-13 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usab...

CVE-2026-44456

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-13 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidate...

CVE-2026-44455

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handlin

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-05-13 发布INFO

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTP...

CVE-2026-44432

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response in

历史摘要 · 未重新核验 · NVD

#cve #cwe-409