2026-05-28 归档

今日共收录 1581 条安全情报，包含 810 个 CVE，383 篇安全通告，以及 109 篇研究论文。

漏洞预警2026-05-27 发布INFO

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write opera...

CVE-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujso

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-05-27 发布INFO

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing...

CVE-2026-21785

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlie

历史摘要 · 未重新核验 · NVD

#cve #cwe-1021

漏洞预警2026-05-27 发布INFO

ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service

CVE-2026-9759

ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-27 发布INFO

A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome

CVE-2026-8361

A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-05-27 发布INFO

Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no ...

CVE-2026-8360

Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWe

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-27 发布INFO

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule funct...

CVE-2026-8359

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-27 发布INFO

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

CVE-2026-49009

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* node...

CVE-2026-48792

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently

历史摘要 · 未重新核验 · NVD

#cve #cwe-390 #cwe-693

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is written on every PAM ...

CVE-2026-48066

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a

历史摘要 · 未重新核验 · NVD

#cve #cwe-362 #cwe-476

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/conf.c allocates heap memory proportional to n_devices, a count derived fr...

CVE-2026-48065

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/conf.c allocates

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-190

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly d...

CVE-2026-48064

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH envi...

CVE-2026-47274

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb help

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username,...

CVE-2026-47273

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side ...

CVE-2026-47272

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare(

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-908

漏洞预警2026-05-27 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstr...

CVE-2026-47271

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-05-27 发布INFO

RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configures its Celery workers to accept and deserialize untrusted ...

CVE-2026-47161

RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configure

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-27 发布INFO

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pu...

CVE-2026-45134

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-05-27 发布INFO

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerabili...

CVE-2026-45108

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11,

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-27 发布INFO

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <R...

CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always

历史摘要 · 未重新核验 · NVD

#cve #cwe-129 #cwe-476

漏洞预警2026-05-27 发布INFO

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /p...

CVE-2026-44886

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-89