Electerm Local code through electerm's single-instance socket
CVE-2026-45353
### Impact _Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's sin
2026-05-15 归档
今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。
← 返回归档列表DeepSeek TUI has SSRF IPV6 bypass
CVE-2026-45373
### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
CVE-2026-42573
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
Svelte: ReDoS in `<svelte:element>` Tag Validation
CVE-2026-42567
An internal regex in the Svelte runtime can take exponential time to test in ``. You are only vulnerable to this if you
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
CVE-2026-45665
### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitiza
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
CVE-2026-45400
### Summary In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF b
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
CVE-2026-45399
### Summary Any authenticated user with low privileges can enumerate active background tasks across the system and stop
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
京公网安备 11000002002063号
该输入信息并非有效的威胁情报报告，而是公安部备案号信息，标题为'京公网安备 11000002002063号'，来源为360CERT安全报告，但实际内容为空，且发布时间为未来时间。无法提取任何威胁活动、攻击者、恶意软件或漏洞信息。可能为测试数
（总）网出证（京）字第281号
输入内容为360.cn的许可证信息页面，标题为“（总）网出证（京）字第281号”，并非安全威胁情报报告。摘要为空，未提供任何攻击活动、漏洞、IOC或相关技术细节。标签中包含malware、apt、report等，但实际内容不相关，可能为误标
京网文〔2020〕6051-1195号
输入内容为平台版权声明和ICP备案号，无实质威胁情报信息。无法生成有效摘要。
京ICP证080047号[京ICP备08010314号-6]
输入内容为空，仅包含网站备案信息（京ICP证080047号[京ICP备08010314号-6]），无有效威胁情报内容。标签包含malware、apt、report、360，但未提供任何技术细节或分析结论。该信息来源为360CERT安全报告，
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQ...
CVE-2026-7373
CVE-2026-7373 是 Rapid7 Metasploit Pro 中的一个本地权限提升漏洞。该漏洞源于 Metasploit Pro 在 Windows 上启动时，其 metasploitPostgreSQL 服务会调用 post
Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid data to a remote Di...
CVE-2026-0428
CVE-2026-0428 是一个影响 TEE SOC 驱动程序的漏洞，涉及参数消毒不足。具体来说，该漏洞存在于 DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS 命令处理过程中。由于对传入的参数缺乏充分的
Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_LOAD_GFX_IP_FW SR-IOV command to cau...
CVE-2025-66664
CVE-2025-66664 是 AMD Secure Processor (ASP) TEE SOC 驱动程序中存在的一个参数清理不足漏洞。该漏洞允许攻击者通过发送格式错误的 DRV_SOC_CMD_ID_LOAD_GFX_IP_FW S
Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cause incorrect shared memory mapping,...
CVE-2025-66660
CVE-2025-66660 是一个影响 TEE（可信执行环境）SOC 驱动程序的安全漏洞。该漏洞源于对 DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT 命令的参数验证不充分。具体而言，攻击者可以通过构造特制的命令
Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficient privileges and ...
CVE-2025-54511
该漏洞存在于AMD安全处理器（ASP）中，源于对权限不足情况的处理不当。攻击者可能利用此漏洞，在缺乏足够权限的情况下向某个函数提供输入值，并成功执行写入操作。这可能导致系统完整性或可用性受损，例如攻击者可能篡改敏感数据或导致服务中断。AMD
Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotected PMIC interface...
CVE-2025-48516
CVE-2025-48516 涉及 AGESA Bootloader Firmware 中 DDR5 内存模块的不安全默认配置问题。该固件在初始化 DDR5 内存时，未对 PMIC（电源管理集成电路）接口实施充分保护，导致默认状态下该接口可
Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in loss of confidentiali...
CVE-2025-48513
CVE-2025-48513 是一个影响 AMD Platform Management Framework (PMF) 的漏洞。该漏洞源于对未初始化资源的使用，可能允许攻击者读取未初始化的内核内存，从而导致机密性丢失或系统可用性下降。由于
A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting in denial of service or crash
CVE-2025-29944
CVE-2025-29944 是一个存在于 AMD Sensor Fusion Hub (SFH) 驱动程序中的缓冲区溢出漏洞。该驱动程序用于融合来自多个传感器的数据，以支持 AMD 平台的传感器功能。漏洞允许具有本地访问权限的攻击者通过精