2026-05-20 归档

今日共收录 1110 条安全情报，包含 284 个 CVE，411 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-05-19 发布INFO

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal wi...

CVE-2026-8492

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource L

历史摘要 · 未重新核验 · NVD

#cve #cwe-471

漏洞预警2026-05-19 发布INFO

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0....

CVE-2026-8491

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Brows

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-05-19 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obf...

CVE-2026-6871

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects D...

CVE-2026-6367

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from...

CVE-2026-6366

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-05-19 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects D...

CVE-2026-6365

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Oreji...

CVE-2026-6095

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime all

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by anothe...

CVE-2026-34744

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and downl

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-281

漏洞预警2026-05-19 发布INFO

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that al...

CVE-2026-34600

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-281 #cwe-863

漏洞预警2026-05-19 发布INFO

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Us...

CVE-2026-34579

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-05-19 发布INFO

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside ...

CVE-2026-5090

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project oth...

CVE-2026-34463

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in Pr...

CVE-2026-34390

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-05-19 发布INFO

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce...

CVE-2026-34358

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access contr

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-862

漏洞预警2026-05-19 发布INFO

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role mana...

CVE-2026-34246

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-80 #cwe-116

漏洞预警2026-05-19 发布INFO

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notificat...

CVE-2026-34241

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited sect...

CVE-2024-36343

Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-124

漏洞预警2026-05-19 发布INFO

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dang...

CVE-2026-39250

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly acces

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-19 发布INFO

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without authorization checks,...

CVE-2026-34233

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-862

漏洞预警2026-05-19 发布INFO

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified class name directly f...

CVE-2026-34216

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update

历史摘要 · 未重新核验 · NVD

#cve #cwe-470