2026-06-06 归档

今日共收录 1443 条安全情报，包含 665 个 CVE，387 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-05 发布INFO

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an una...

CVE-2026-11414

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Beca

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-798

漏洞预警2026-06-05 发布INFO

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to e...

CVE-2026-11401

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL w

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-06-05 发布INFO

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to...

CVE-2026-11400

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-06-05 发布INFO

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all vers...

CVE-2026-5415

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for Wor

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-06-05 发布INFO

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all vers...

CVE-2026-5411

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for Wor

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/syst...

CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-522 #cwe-922

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitiz...

CVE-2026-46496

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An att...

CVE-2026-46399

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-73 #cwe-78

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitiz...

CVE-2026-46396

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cry...

CVE-2026-46395

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-321 #cwe-327

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms P...

CVE-2026-46394

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authent...

CVE-2026-46393

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF)

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitive...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFi

历史摘要 · 未重新核验 · NVD

#cve #cwe-178 #cwe-434

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct su...

CVE-2026-46391

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-183 #cwe-918

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated user...

CVE-2026-46390

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-05 发布INFO

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects ...

CVE-2026-50733

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), a

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-06-05 发布INFO

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbit...

CVE-2026-49493

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-05 发布INFO

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document -...

CVE-2026-49492

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not val

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-05 发布INFO

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` ...

CVE-2026-45749

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST

历史摘要 · 未重新核验 · NVD

#cve #cwe-308

漏洞预警2026-06-05 发布INFO

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS c...

CVE-2026-45745

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting i

历史摘要 · 未重新核验 · NVD

#cve #cwe-295