2026-05-23 归档

今日共收录 869 条安全情报，包含 93 个 CVE，394 篇安全通告，以及 104 篇研究论文。

漏洞预警2026-05-22 发布INFO

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation pro...

CVE-2026-39833

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enf

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently...

CVE-2026-39832

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serializ

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated w...

CVE-2026-39831

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released...

CVE-2026-39830

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several min...

CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessive

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate res...

CVE-2026-39828

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affectin...

CVE-2026-39827

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory gr

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP...

CVE-2026-9264

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution an

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-22 发布INFO

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system t...

CVE-2026-34911

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in Un

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vu...

CVE-2026-8435

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file appr

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vu...

CVE-2026-8434

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file resc

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerabil...

CVE-2026-8433

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file resc

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerabilit...

CVE-2026-8432

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gav...

CVE-2026-8427

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file remo

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave t...

CVE-2026-8416

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addF

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave th...

CVE-2026-8415

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/as

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerabi...

CVE-2026-8414

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/dupl

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerab...

CVE-2026-8413

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerab...

CVE-2026-8412

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275

漏洞预警2026-05-21 发布INFO

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerab...

CVE-2026-8411

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1275