2026-05-20 归档

今日共收录 1110 条安全情报，包含 284 个 CVE，411 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When...

CVE-2026-32882

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted t...

CVE-2026-32814

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid imag

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-908

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF...

CVE-2026-32741

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-05-19 发布INFO

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerabili...

CVE-2025-57798

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-05-19 发布INFO

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` contai...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing...

CVE-2026-32740

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (wr

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_d...

CVE-2026-32739

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequen

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-05-19 发布INFO

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only a...

CVE-2026-27173

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kube

历史摘要 · 未重新核验 · NVD

#cve #cwe-538

漏洞预警2026-05-19 发布INFO

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris ...

CVE-2026-8370

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-05-19 发布INFO

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is d...

CVE-2026-8096

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-19 发布INFO

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missin...

CVE-2026-8073

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file del

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-05-19 发布INFO

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticat...

CVE-2026-41470

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows at

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-19 发布INFO

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin ...

CVE-2026-34154

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-19 发布INFO

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-ca...

CVE-2026-33741

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-19 发布INFO

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host overrid...

CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-19 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes a...

CVE-2026-32738

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequen

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-476

漏洞预警2026-05-19 发布INFO

In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

CVE-2026-8605

In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA syst

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-05-19 发布INFO

In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious...

CVE-2026-8604

In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a vic

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-19 发布INFO

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

CVE-2026-8603

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-19 发布INFO

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system an...

CVE-2026-8602

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-306