2026-06-12 归档

今日共收录 1106 条安全情报，包含 305 个 CVE，402 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain d...

CVE-2026-53817

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages fr...

CVE-2026-53815

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-a...

CVE-2026-53814

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly rece

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with ...

CVE-2026-53813

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks thr...

CVE-2026-53812

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entries through mutable...

CVE-2026-53811

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers ...

CVE-2026-53810

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redir

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of cano...

CVE-2026-53809

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy...

CVE-2026-53808

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. ...

CVE-2026-53807

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-11 发布INFO

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by ...

CVE-2026-53806

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-06-11 发布INFO

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.

CVE-2026-50245

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is r

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-06-11 发布INFO

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.

CVE-2026-50005

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera

历史摘要 · 未重新核验 · NVD

#cve #cwe-1392

漏洞预警2026-06-11 发布INFO

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content ...

CVE-2026-53782

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-11 发布INFO

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced si...

CVE-2026-53781

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-11 发布INFO

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-d...

CVE-2026-49949

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercep

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-06-11 发布INFO

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_toke...

CVE-2026-46622

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-06-11 发布INFO

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administra...

CVE-2026-46489

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-06-11 发布INFO

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload...

CVE-2026-45802

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-06-11 发布INFO

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker could potentially bypa...

CVE-2026-45175

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-295