2026-05-21 归档

今日共收录 1079 条安全情报，包含 251 个 CVE，425 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-05-20 发布INFO

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of th...

CVE-2026-42534

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purp

历史摘要 · 未重新核验 · NVD

#cve #cwe-440

漏洞预警2026-05-20 发布INFO

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sendi...

CVE-2026-41292

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsin

历史摘要 · 未重新核验 · NVD

#cve #cwe-407 #cwe-770

漏洞预警2026-05-20 发布INFO

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to...

CVE-2026-40622

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of a

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-05-20 发布INFO

Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high...

CVE-2026-35070

Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-05-20 发布INFO

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query...

CVE-2026-32792

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNS

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-166

漏洞预警2026-05-20 发布INFO

SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API en...

CVE-2026-9065

SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'mo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-20 发布INFO

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/...

CVE-2026-9059

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-20 发布INFO

The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions ...

CVE-2026-6405

The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF)

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-20 发布INFO

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and...

CVE-2026-5200

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is v

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-20 发布INFO

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing ...

CVE-2026-7385

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post au

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-20 发布INFO

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. T...

CVE-2026-6566

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-20 发布INFO

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks

CVE-2026-5776

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unau

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-20 发布INFO

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because me

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-05-20 发布INFO

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_s...

CVE-2026-47783

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-05-20 发布INFO

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update pro...

CVE-2026-44392

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-20 发布INFO

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including,...

CVE-2026-2955

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-20 发布INFO

A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This iss...

CVE-2026-9057

A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” pe

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-20 发布INFO

A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be...

CVE-2026-9056

A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permiss

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-20 发布INFO

The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter. This mak...

CVE-2026-7522

The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-05-20 发布INFO

The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due t...

CVE-2026-5075

The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized

历史摘要 · 未重新核验 · NVD

#cve #cwe-200