2026-06-10 归档

今日共收录 1730 条安全情报，包含 831 个 CVE，478 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-10 发布INFO

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_b...

CVE-2026-46539

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-06-10 发布INFO

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in...

CVE-2026-46518

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-862

漏洞预警2026-06-10 发布INFO

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE...

CVE-2026-46517

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardc

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-915 #cwe-1188

漏洞预警2026-06-10 发布INFO

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths...

CVE-2026-46491

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-10 发布INFO

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through har...

CVE-2026-46432

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDep

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-10 发布INFO

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their w...

CVE-2026-46411

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have t

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-06-10 发布INFO

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process b...

CVE-2026-45782

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-10 发布INFO

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulne...

CVE-2026-44716

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-10 发布INFO

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dh...

CVE-2026-44505

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-

历史摘要 · 未重新核验 · NVD

#cve #cwe-755

漏洞预警2026-06-10 发布INFO

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing ...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-10 发布INFO

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additiona...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any pac

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-10 发布INFO

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitl...

CVE-2026-41731

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-10 发布INFO

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions:...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-06-10 发布INFO

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent ent...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (app

历史摘要 · 未重新核验 · NVD

#cve #cwe-917

漏洞预警2026-06-10 发布INFO

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JS...

CVE-2026-41728

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to int

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-10 发布INFO

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.sele...

CVE-2026-41726

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-10 发布INFO

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method u...

CVE-2026-41721

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Sup

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-06-10 发布INFO

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the Spe...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-917

漏洞预警2026-06-10 发布INFO

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository que...

CVE-2026-41717

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs du

历史摘要 · 未重新核验 · NVD

#cve #cwe-917

漏洞预警2026-06-10 发布INFO

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affect...

CVE-2026-41716

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, al

历史摘要 · 未重新核验 · NVD

#cve #cwe-770