2026-05-15 归档

今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3....

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-789

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when ...

CVE-2026-42581

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjec

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request...

CVE-2026-42580

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's c

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-444

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraint...

CVE-2026-42579

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's D

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-400 #cwe-626

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with hea...

CVE-2026-42578

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's H

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-05-13 发布INFO

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that r...

CVE-2026-42577

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll t

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke...

CVE-2026-42032

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke...

CVE-2026-42031

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated reque...

CVE-2026-41255

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any cert...

CVE-2026-41132

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-13 发布INFO

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unex...

CVE-2026-33585

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-233

漏洞预警2026-05-13 发布INFO

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. ...

CVE-2026-33584

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-05-13 发布INFO

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the ...

CVE-2026-33583

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via a

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-05-13 发布INFO

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

CVE-2026-30906

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user t

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-05-13 发布INFO

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation...

CVE-2026-30905

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-05-13 发布INFO

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.

CVE-2026-30904

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-05-13 发布INFO

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by i...

CVE-2026-22677

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-13 发布INFO

Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileg...

CVE-2026-0247

Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-13 发布INFO

Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on ...

CVE-2026-0245

Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configura

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-13 发布INFO

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploita...

CVE-2026-0242

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL c

历史摘要 · 未重新核验 · NVD

#cve #cwe-89