2026-06-22 归档

今日共收录 737 条安全情报，包含 75 个 CVE，376 篇安全通告，以及 39 篇研究论文。

漏洞预警2026-06-21 发布INFO

Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field ...

CVE-2026-56393

Craft CMS 4.x (>= 4.0.0-RC1, = 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities w

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-21 发布INFO

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset...

CVE-2026-56385

Craft CMS versions >= 5.0.0-RC1, = 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-21 发布INFO

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call th...

CVE-2026-56384

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user with

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-21 发布INFO

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanit...

CVE-2026-56383

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-21 发布INFO

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method...

CVE-2026-56382

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-21 发布INFO

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escapi...

CVE-2026-56381

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-21 发布INFO

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out...

CVE-2026-56378

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-21 发布INFO

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap ...

CVE-2026-56367

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-21 发布INFO

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid b...

CVE-2026-56316

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint t

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 erro...

CVE-2026-56299

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organizatio...

CVE-2026-56253

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin. Attacke...

CVE-2026-56251

Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API k...

CVE-2026-56242

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns th

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing opera...

CVE-2026-56239

Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-06-21 发布INFO

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can crea...

CVE-2026-56236

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations th

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-06-21 发布INFO

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to diffe...

CVE-2026-56229

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-21 发布INFO

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypas...

CVE-2025-71378

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-21 发布INFO

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pi...

CVE-2025-71357

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-21 发布INFO

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the reduce method, allowing remote code execution. Attackers can craft pickle fil...

CVE-2025-71351

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-06-21 发布INFO

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle fil...

CVE-2025-71348

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-502