2026-05-19 归档

今日共收录 917 条安全情报，包含 132 个 CVE，384 篇安全通告，以及 107 篇研究论文。

漏洞预警2026-05-18 发布INFO

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the CO...

CVE-2026-47092

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-05-18 发布INFO

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcrip...

CVE-2026-47091

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to r

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-18 发布INFO

Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control character...

CVE-2026-47090

Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials...

CVE-2026-45246

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite p

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links...

CVE-2026-45245

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

历史摘要 · 未重新核验 · NVD

#cve #cwe-918 #cwe-940

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the exte...

CVE-2026-45244

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automa

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-18 发布INFO

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

CVE-2026-21789

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certai

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-18 发布INFO

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url que...

CVE-2025-65954

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions bel

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized oper...

CVE-2026-45243

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories ...

CVE-2026-45242

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-18 发布INFO

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored w...

CVE-2026-45231

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, descripti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-18 发布INFO

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is ...

CVE-2026-32849

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/op

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-476

漏洞预警2026-05-18 发布INFO

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free con...

CVE-2026-32848

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem

历史摘要 · 未重新核验 · NVD

#cve #cwe-362 #cwe-415

漏洞预警2026-05-18 发布INFO

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses ...

CVE-2026-29965

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-18 发布INFO

HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alterna...

CVE-2026-29964

HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to impro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-18 发布INFO

HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to constru...

CVE-2026-29963

HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-18 发布INFO

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php p...

CVE-2026-29962

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-suppli

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-18 发布INFO

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST r...

CVE-2023-24215

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-18 发布INFO

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will cr...

CVE-2026-8843

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-05-18 发布INFO

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the serve...

CVE-2026-45829

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un

历史摘要 · 未重新核验 · NVD

#cve #cwe-94