2026-05-27 归档

今日共收录 1142 条安全情报，包含 375 个 CVE，381 篇安全通告，以及 103 篇研究论文。

漏洞预警2026-05-26 发布INFO

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any p...

CVE-2026-47672

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-05-26 发布INFO

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the ID...

CVE-2026-45575

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via rainbow tables or G...

CVE-2026-45413

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes

历史摘要 · 未重新核验 · NVD

#cve #cwe-328

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in work_flow_template.down...

CVE-2026-45412

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated u

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _n...

CVE-2026-44899

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-26 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id, text) tuples. Bot...

CVE-2026-44898

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a table-of-conte

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-26 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value...

CVE-2026-44897

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the openin

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-26 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and realier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and ...

CVE-2026-44896

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and realier, in src/mistune/directives/image.py

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication...

CVE-2026-44847

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/w

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-05-26 发布INFO

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.get_r...

CVE-2026-44844

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-05-26 发布INFO

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, ru...

CVE-2026-44843

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-26 发布INFO

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a...

CVE-2026-44837

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-187

漏洞预警2026-05-26 发布INFO

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name ...

CVE-2026-44836

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-05-26 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the...

CVE-2026-44708

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline m

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-26 发布INFO

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not validate any value ...

CVE-2026-44443

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level varia

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-05-26 发布INFO

Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Appl...

CVE-2026-44209

Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Env

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/ap...

CVE-2026-42337

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functi...

CVE-2026-42336

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forge

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service...

CVE-2026-42335

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

CVE-2026-36239

PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

历史摘要 · 未重新核验 · NVD

#cve