Chrome Beta for iOS Update
Hi everyone! We've just released Chrome Beta 149 (149.0.7827.12) for iOS; it'll become available on App Store in the nex
2026-05-14 归档
今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。
← 返回归档列表PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026) (Severity: MEDIUM)
PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026) (Severity: MEDIUM)
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of...
CVE-2026-41281
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CW
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint...
CVE-2026-45229
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System...
CVE-2026-45228
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin...
CVE-2025-27851
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attac
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to...
CVE-2025-27853
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU we
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously...
CVE-2026-8496
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar in
Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to...
CVE-2026-0245
Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configura
Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an...
CVE-2026-30904
Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA...
CVE-2026-33585
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacke
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
CVE-2026-22706
### Summary of CVE-2026-22706 Vulnerability Details - CVE: CVE-2026-22706 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...
CVE-2026-8367
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could...
CVE-2026-6281
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authentic
A potential improper file path validation vulnerability was reported in some Lenovo Personal...
CVE-2026-6282
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that
In the Linux kernel, the following vulnerability has been resolved: liveupdate: luo_file:...
CVE-2026-43489
In the Linux kernel, the following vulnerability has been resolved: liveupdate: luo_file: remember retrieve() status L
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt...
CVE-2026-43488
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt storm on host controll
SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution
CVE-2026-45375
### Summary SiYuan's Bazaar (community marketplace) renders the `name` and `version` fields of a package's `plugin.json
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
CVE-2026-45083
### Summary The Goobi viewer REST endpoint `POST /api/v1/index/stream` accepted an arbitrary Solr streaming expression
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
CVE-2026-44797
### Impact Nautobot's `Webhook` data model and associated feature set could be configured by users with sufficient acce