2026-05-28 归档

今日共收录 1581 条安全情报，包含 810 个 CVE，383 篇安全通告，以及 109 篇研究论文。

漏洞预警2026-05-27 发布INFO

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrat...

CVE-2026-6957

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to constr

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

CVE-2026-49103

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. Thi

历史摘要 · 未重新核验 · NVD

#cve #cwe-24

漏洞预警2026-05-27 发布INFO

Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe typ...

CVE-2026-49102

Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes compo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-27 发布INFO

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCommerce: from n/a th...

CVE-2026-49059

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing.

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Eleme...

CVE-2026-49053

Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Eleme...

CVE-2026-49052

Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP M...

CVE-2026-49051

Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DearFlip: from n/a through ...

CVE-2026-49047

Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Access Control Securit

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issu...

CVE-2026-49046

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Dupli

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a thro...

CVE-2026-49045

Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Secur

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field allows Stored XSS. ...

CVE-2026-49044

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advan

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-27 发布INFO

Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SVG Support: from n/a th...

CVE-2026-48973

Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Secu

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-27 发布INFO

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to con...

CVE-2026-48927

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-27 发布INFO

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate c...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-27 发布INFO

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

CVE-2026-48925

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-27 发布INFO

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

CVE-2026-48924

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-05-27 发布INFO

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to conn...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-05-27 发布INFO

Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide cre...

CVE-2026-48922

Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-05-27 发布INFO

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content ...

CVE-2026-48921

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared l

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-05-27 发布INFO

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by set

历史摘要 · 未重新核验 · NVD

#cve #cwe-73