2026-05-28 归档

今日共收录 1581 条安全情报，包含 810 个 CVE，383 篇安全通告，以及 109 篇研究论文。

← 返回归档列表

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware s...

CVE-2026-48151

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no san...

CVE-2026-48149

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against int...

CVE-2026-48148

Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.ts route patterns a...

CVE-2026-48147

Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages

历史摘要 · 未重新核验 · NVD

#cve #cwe-185 #cwe-352

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(config.url) wi...

CVE-2026-48146

Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sd

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly ...

CVE-2026-48128

Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a qu

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields ...

CVE-2026-46427

Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/dataso

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authentica...

CVE-2026-46426

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process do

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB b...

CVE-2026-46424

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/publ

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated dire...

CVE-2026-45719

Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint (POST /api/tables/:sourceId/actions/:actionId/trigger) fails to validate that the ...

CVE-2026-45718

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint (POST /api/tables/:source

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourceId is registered ...

CVE-2026-45717

Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user ...

CVE-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-check...

CVE-2026-45715

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/inte

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly wi...

CVE-2026-45548

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automa

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worke...

CVE-2026-45090

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pk

历史摘要 · 未重新核验 · NVD

#cve #cwe-362 #cwe-404

漏洞预警2026-05-27 发布INFO

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fi...

CVE-2026-45089

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in R

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-306 #cwe-434

漏洞预警2026-05-27 发布INFO

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in mod...

CVE-2026-45088

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in R

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-306 #cwe-552

漏洞预警2026-05-27 发布INFO

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper auth...

CVE-2026-45081

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single substring check: url....

CVE-2026-45061

Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-918