2026-06-19 归档

今日共收录 997 条安全情报，包含 210 个 CVE，375 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-17 发布INFO

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product w...

CVE-2026-53676

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed c

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-06-17 发布INFO

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4...

CVE-2026-50268

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-256 #cwe-327

漏洞预警2026-06-17 发布INFO

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through...

CVE-2026-50267

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-732

漏洞预警2026-06-17 发布INFO

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase...

CVE-2026-50202

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-668

漏洞预警2026-06-17 发布INFO

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2...

CVE-2026-50201

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-285

漏洞预警2026-06-17 发布INFO

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and delet...

CVE-2026-48759

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability thro

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-17 发布INFO

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing f...

CVE-2026-45617

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-06-17 发布INFO

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width s...

CVE-2026-45357

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-06-17 发布INFO

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, Context.spawn() creates a child Context for the {% rende...

CVE-2026-44646

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-06-17 发布INFO

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in the strip_html filte...

CVE-2026-44644

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-17 发布INFO

The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name co...

CVE-2026-12568

The postman_download module uses the workspace name field from the Postman API to construct the local directory path wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-17 发布INFO

The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory c...

CVE-2026-12567

The github_workflows module constructs local directory paths from user-controlled repository names without validating fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-06-17 发布INFO

The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man...

CVE-2026-12566

The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-17 发布INFO

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GN...

CVE-2026-12565

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-17 发布INFO

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset t...

CVE-2024-27928

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks

历史摘要 · 未重新核验 · NVD

#cve #cwe-308

漏洞预警2026-06-17 发布INFO

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Curren...

CVE-2024-24769

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-06-17 发布INFO

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer without first verifying that it is non-NULL. Sending an IOCTL w...

CVE-2026-8050

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer withou

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-17 发布INFO

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_OPEN. This results ...

CVE-2026-8049

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security desc

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-17 发布INFO

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploit...

CVE-2026-54386

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-17 发布INFO

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2...

CVE-2026-50200

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-319