2026-06-19 归档

今日共收录 997 条安全情报，包含 210 个 CVE，375 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-18 发布INFO

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

CVE-2026-47633

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-18 发布INFO

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

CVE-2026-32174

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-06-18 发布INFO

Hashgraph Guardian through 3.5.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role t...

CVE-2026-22674

Hashgraph Guardian through 3.5.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-18 发布INFO

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without vali...

CVE-2026-49248

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-06-18 发布INFO

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerabili...

CVE-2026-46699

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-18 发布INFO

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K (High...

CVE-2026-45696

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-06-18 发布INFO

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer over...

CVE-2026-44663

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-787

漏洞预警2026-06-18 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len f...

CVE-2026-43994

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer ove

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-06-18 发布INFO

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH serve...

CVE-2025-15661

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink()

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-18 发布INFO

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attacker...

CVE-2026-56099

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-18 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad dir...

CVE-2026-48983

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-06-18 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created usi...

CVE-2026-48982

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when upda

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-06-18 发布INFO

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configur...

CVE-2026-48981

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb c

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-06-18 发布INFO

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow enviro...

CVE-2026-48980

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environm

历史摘要 · 未重新核验 · NVD

#cve #cwe-454 #cwe-807

漏洞预警2026-06-18 发布INFO

nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from a...

CVE-2026-48716

nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts con

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-18 发布INFO

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPL...

CVE-2026-47847

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-06-18 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS in...

CVE-2026-43915

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-sit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-18 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been re...

CVE-2026-2842

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-18 发布INFO

Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's cal...

CVE-2026-25865

Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to e

历史摘要 · 未重新核验 · NVD

#cve #cwe-428

漏洞预警2026-06-18 发布INFO

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in r...

CVE-2026-9692

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id

历史摘要 · 未重新核验 · NVD

#cve #cwe-338 #cwe-340