2026-05-15 归档

今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenti...

CVE-2026-1322

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-840

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthentic...

CVE-2026-1184

GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-14 发布INFO

The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to...

CVE-2025-15345

The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' par

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthen...

CVE-2025-14870

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthen...

CVE-2025-14869

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenti...

CVE-2025-13874

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-14 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authent...

CVE-2025-12669

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-14 发布INFO

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not ...

CVE-2026-7525

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-14 发布INFO

The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient in...

CVE-2026-5361

The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions u

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-14 发布INFO

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up...

CVE-2026-5486

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' p

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-14 发布INFO

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

CVE-2026-46446

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This i

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-14 发布INFO

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

CVE-2026-46445

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-14 发布INFO

Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.

CVE-2026-46419

Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value i

历史摘要 · 未重新核验 · NVD

#cve #cwe-253

漏洞预警2026-05-14 发布INFO

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

CVE-2026-44919

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can oc

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-05-14 发布INFO

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may ac...

CVE-2026-41281

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CW

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-05-13 发布INFO

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

CVE-2026-32991

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-13 发布INFO

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

CVE-2026-29206

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the roo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by check...

CVE-2026-44478

hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the una

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-287

漏洞预警2026-05-13 发布INFO

gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-...

CVE-2026-44471

gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-05-13 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing use...

CVE-2026-44448

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints fa

历史摘要 · 未重新核验 · NVD

#cve #cwe-862