2026-05-22 归档

今日共收录 1105 条安全情报，包含 281 个 CVE，422 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-05-21 发布INFO

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission...

CVE-2026-7879

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php all

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-21 发布INFO

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing ...

CVE-2026-5091

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions us

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-05-21 发布INFO

Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field for...

CVE-2026-4929

Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-21 发布INFO

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module i...

CVE-2026-4093

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-21 发布INFO

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privilege...

CVE-2026-22678

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/control...

CVE-2026-8428

Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-829

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker who controls ...

CVE-2026-8426

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepa

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-829

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker who can...

CVE-2026-8421

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/singl

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/cont...

CVE-2026-8417

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_up

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-21 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been re...

CVE-2026-8352

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authentic...

CVE-2026-8350

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restrict...

CVE-2026-8205

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does no

历史摘要 · 未重新核验 · NVD

#cve #cwe-425

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block ...

CVE-2026-8204

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious J...

CVE-2026-8203

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $heigh

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concret...

CVE-2026-8197

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template render

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method in concrete/contro...

CVE-2026-8140

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/down

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator w...

CVE-2026-8135

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the Ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An...

CVE-2026-8134

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTempl

历史摘要 · 未重新核验 · NVD

#cve #cwe-23 #cwe-98 #cwe-434

漏洞预警2026-05-21 发布INFO

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can reque...

CVE-2026-6826

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-21 发布INFO

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own accou...

CVE-2026-47102

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c

历史摘要 · 未重新核验 · NVD

#cve #cwe-863