2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

← 返回归档列表

漏洞预警2026-05-12 发布INFO

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using ...

CVE-2026-45227

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-05-12 发布INFO

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim work...

CVE-2026-45226

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-12 发布INFO

Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations ...

CVE-2026-45225

Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-12 发布INFO

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation ...

CVE-2026-44871

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-05-12 发布INFO

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Te...

CVE-2026-44307

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-12 发布INFO

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed...

CVE-2026-44306

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-05-12 发布INFO

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certifica...

CVE-2026-44305

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-12 发布INFO

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via P...

CVE-2026-44304

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) construc

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-05-12 发布INFO

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressin...

CVE-2026-44302

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStr

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-05-12 发布INFO

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the conf...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipel

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-12 发布INFO

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.167, a remote, unauthenticated denial of service (DoS) vulnerability affects Deskflow servers running with TLS enab...

CVE-2026-44296

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.167, a remote, unauthenticated denial of service (DoS) vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-405

漏洞预警2026-05-12 发布INFO

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true,...

CVE-2026-44260

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the JSP tag is intended to preve

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-12 发布INFO

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitiza...

CVE-2026-44259

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME t

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-05-12 发布INFO

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not ...

CVE-2026-44258

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targe

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-12 发布INFO

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical...

CVE-2026-44257

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk usin

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-05-12 发布INFO

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Loca...

CVE-2026-44242

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applicat

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-12 发布INFO

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, TimeConverterRegistra...

CVE-2026-44241

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applicat

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-05-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node ...

CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-12 发布INFO

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication impleme...

CVE-2026-42855

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-05-12 发布INFO

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YA...

CVE-2026-42844

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-434