PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from rele...

CVE-2026-41011

该漏洞存在于 BOSH（一种用于大规模部署和编排软件的云管理平台）的 PackagePersister 组件的 validate_tgz 方法中。在解包上传的压缩包时，方法从 release.MF 中读取包名称（name），并直接拼接成 s

历史摘要 · 未重新核验 · NVD

An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker wi...

CVE-2026-7764

CVE-2026-7764 是 Morse Micro HaLowLink 2 软件（版本低于 2.11.12）中 morse.ko HaLow Wi-Fi 内核驱动的一个越界读取漏洞。该驱动用于 802.11ah（HaLow）标准，支持远

历史摘要 · 未重新核验 · NVD

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, an...

CVE-2026-10737

SP Project & Document Manager 是一个 WordPress 插件，用于管理项目文件和文档。该插件在 4.71 及之前版本中存在一个未授权访问漏洞（CVE-2026-10737），源于 view_file 函数缺少

历史摘要 · 未重新核验 · NVD

Human Factors in Cybersecurity in Icelandic Small and Medium-sized Enterprises

本研究通过问卷调查（N=130）探讨了冰岛公共和私营部门组织（包括关键基础设施提供商）在网络安全中面临的人为因素挑战。研究发现，从管理层视角来看，人为因素被强烈视为安全障碍，包括缺乏充分的培训或安全意识、招聘困难、网络安全文化薄弱以及时间/

历史摘要 · 未重新核验 · arXiv cs.CR

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

CVE-2026-46447

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info o

历史摘要 · 未重新核验 · NVD

Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.

CVE-2026-22055

Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low p

历史摘要 · 未重新核验 · NVD

Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operati...

CVE-2026-22054

Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with l

历史摘要 · 未重新核验 · NVD

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUt...

CVE-2026-10771

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-

历史摘要 · 未重新核验 · NVD

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVE-2026-50033

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock D

历史摘要 · 未重新核验 · NVD

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVE-2026-44682

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock D

历史摘要 · 未重新核验 · NVD

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVE-2026-44609

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock D

历史摘要 · 未重新核验 · NVD

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured...

CVE-2026-43924

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module doe

历史摘要 · 未重新核验 · NVD

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051...

CVE-2026-42061

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

历史摘要 · 未重新核验 · NVD

Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page

CVE-2026-37700

Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via t

历史摘要 · 未重新核验 · NVD

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitial...

CVE-2026-26825

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reacha

历史摘要 · 未重新核验 · NVD

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in ...

CVE-2026-26824

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory al

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the compon...

CVE-2026-10766

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_datafr

历史摘要 · 未重新核验 · NVD

Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).

CVE-2026-8889

Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) an

历史摘要 · 未重新核验 · NVD

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without co...

CVE-2026-8888

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as J

历史摘要 · 未重新核验 · NVD

Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single ...

CVE-2026-8881

Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES

历史摘要 · 未重新核验 · NVD