2026-06-12 归档

今日共收录 1106 条安全情报，包含 305 个 CVE，402 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will resul...

CVE-2026-46559

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-193 #cwe-787

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur...

CVE-2026-46557

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF ...

CVE-2026-46521

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-131 #cwe-252 #cwe-787 #cwe-835

漏洞预警2026-06-10 发布INFO

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the...

CVE-2026-44693

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, P

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-06-10 发布INFO

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search...

CVE-2026-42568

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `or

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-06-10 发布INFO

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes ...

CVE-2026-42563

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to v

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-10 发布INFO

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Sto...

CVE-2026-42558

Xibo is an open source digital signage platform with a web content management system and Windows display player software

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116 #cwe-346

漏洞预警2026-06-10 发布INFO

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote co...

CVE-2026-42305

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-10 发布INFO

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or con...

CVE-2024-21944

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, r

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-10 发布INFO

Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can ...

CVE-2026-53742

Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-10 发布INFO

Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes int...

CVE-2026-53741

Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal withou

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-10 发布INFO

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a...

CVE-2026-53740

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-10 发布INFO

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attacke...

CVE-2026-53739

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notic

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-06-10 发布INFO

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delet...

CVE-2026-53738

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handli

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-10 发布INFO

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject...

CVE-2026-53737

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-10 发布INFO

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an a...

CVE-2026-53736

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handle

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-06-10 发布INFO

Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command...

CVE-2026-53634

Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-10 发布INFO

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by addi...

CVE-2026-50131

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SS

历史摘要 · 未重新核验 · NVD

#cve #cwe-918 #cwe-1286 #cwe-1389

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strin...

CVE-2026-48110

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as Op...

CVE-2026-48108

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-20