2026-06-12 归档

今日共收录 1106 条安全情报，包含 305 个 CVE，402 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server c...

CVE-2026-48107

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-10 发布INFO

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing att...

CVE-2026-48011

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the us

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_M...

CVE-2026-46705

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size ...

CVE-2026-46702

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabl

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-10 发布INFO

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand neste...

CVE-2026-46689

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-400 #cwe-674

漏洞预警2026-06-10 发布INFO

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer...

CVE-2026-46679

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-400 #cwe-401

漏洞预警2026-06-10 发布INFO

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths....

CVE-2026-46673

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecke

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-10 发布INFO

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check ...

CVE-2026-46669

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-10 发布INFO

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures wi...

CVE-2026-46668

SpiceDB is an open source database system for creating and managing security-critical application permissions. From vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-10 发布INFO

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce...

CVE-2026-46654

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-1240

漏洞预警2026-06-10 发布INFO

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain ass...

CVE-2026-46625

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal as

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-u...

CVE-2026-46523

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decod...

CVE-2026-46522

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-835

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with differ...

CVE-2026-46520

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-787

漏洞预警2026-06-10 发布INFO

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht nod...

CVE-2026-45783

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote pee

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-400

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG co...

CVE-2026-45664

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407 #cwe-674

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion ...

CVE-2026-45624

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-129

漏洞预警2026-06-10 发布INFO

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability...

CVE-2026-45384

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-377

漏洞预警2026-06-10 发布INFO

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder:...

CVE-2026-45380

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-193

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top...

CVE-2026-45359

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-129