2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

漏洞预警2026-05-12 发布INFO

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operati...

CVE-2026-44856

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through t

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-05-12 发布INFO

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operati...

CVE-2026-44855

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through t

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-05-12 发布INFO

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote ...

CVE-2026-44854

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-05-12 发布INFO

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote ...

CVE-2026-44853

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-05-12 发布INFO

An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality cou...

CVE-2026-44852

An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vu

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-12 发布INFO

vLLM is an inference and serving engine for large language models (LLMs). From to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tenso...

CVE-2026-44223

vLLM is an inference and serving engine for large language models (LLMs). From to before 0.20.0, the extract_hidden_sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-131 #cwe-704

漏洞预警2026-05-12 发布INFO

vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing...

CVE-2026-44222

vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Toke

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-05-12 发布INFO

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function in src/ciguard/discovery.py walks a directory tree followi...

CVE-2026-44220

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function i

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-05-12 发布INFO

ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py) ...

CVE-2026-44219

ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyz

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-12 发布INFO

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the D...

CVE-2026-44218

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard con

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-12 发布INFO

sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed ...

CVE-2026-44217

sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, impl

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip....

CVE-2026-44215

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write e

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulne...

CVE-2026-42446

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. ...

CVE-2026-42445

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The ha...

CVE-2026-42444

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists i

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerabil...

CVE-2026-42443

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UF

历史摘要 · 未重新核验 · NVD

#cve #cwe-369

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerabi...

CVE-2026-42442

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the U

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-12 发布INFO

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. Wh...

CVE-2026-42355

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-05-12 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-con...

CVE-2026-42338

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.gr

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-12 发布INFO

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exp...

CVE-2026-42191

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to

历史摘要 · 未重新核验 · NVD

#cve #cwe-379