iOS 16.7.16 and iPadOS 16.7.16
iOS 16.7.16 and iPadOS 16.7.16
2026-05-23 归档
今日共收录 869 条安全情报，包含 93 个 CVE，394 篇安全通告，以及 104 篇研究论文。
← 返回归档列表iOS 15.8.8 and iPadOS 15.8.8
iOS 15.8.8 and iPadOS 15.8.8
MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0
MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 150 (150.0.7847.3) for Android. It's now available on Google Play.You can se
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
CVE-2026-46716
## Summary `nezha`'s dashboard supports two user roles: `RoleAdmin` (Role==0) and `RoleMember` (Role==1). The cron rout
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
CVE-2026-46715
### Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an O
YesWiki: Unauthenticated SQL Injection
CVE-2026-46670
### Summary An unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthe
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows...
CVE-2026-9264
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution an
A malicious actor with access to the network could exploit an Improper Input Validation...
CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
A malicious actor with access to the network could exploit an Improper Access Control...
CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a
A malicious actor with access to the network and high privileges could exploit an Improper Input...
CVE-2026-33000
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete...
CVE-2026-8415
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/as
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing...
CVE-2026-6960
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
CVE-2026-46701
# Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret | Field | Value | | ------------
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
CVE-2026-46703
#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
CVE-2026-46678
## Summary When an application using Pydantic AI opts a URL into `force_download='allow-local'` (which disables the def
SQLAdmin: Authorization Bypass on `ajax_lookup`
CVE-2026-46645
### Impact The `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all
Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token-...
CVE-2026-8428
Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but
Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not...
CVE-2026-8203
Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $heigh