2026-06-23 归档

今日共收录 1003 条安全情报，包含 243 个 CVE，376 篇安全通告，以及 99 篇研究论文。

漏洞预警2026-06-22 发布INFO

Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘telefon’ fields. T...

CVE-2026-7166

Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and p

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-22 发布INFO

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without...

CVE-2026-7165

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-22 发布INFO

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unaut...

CVE-2026-6673

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlas

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-06-22 发布INFO

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML ...

CVE-2026-6653

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-416 #cwe-611

漏洞预警2026-06-22 发布INFO

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edit...

CVE-2026-6062

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel o

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-22 发布INFO

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call with...

CVE-2026-5139

Mattermost versions 11.7.x }} slash command.. Mattermost Advisory ID: MMSA-2026-00644

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-22 发布INFO

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully...

CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reac

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-06-22 发布INFO

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafte...

CVE-2026-56448

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e4

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-22 发布INFO

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and pa...

CVE-2026-56447

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-06-22 发布INFO

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled con...

CVE-2026-56446

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-22 发布INFO

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important s...

CVE-2026-56425

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorizat

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-06-22 发布INFO

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing o...

CVE-2026-56424

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862 #cwe-863

漏洞预警2026-06-22 发布INFO

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using...

CVE-2026-56423

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The af

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-22 发布INFO

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifyi...

CVE-2026-54100

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishe

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-06-22 发布INFO

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request ...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR au

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-06-22 发布INFO

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access ...

CVE-2026-42129

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-22 发布INFO

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An...

CVE-2026-12888

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canaryt

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-06-22 发布INFO

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s ...

CVE-2026-12602

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assig

历史摘要 · 未重新核验 · NVD

#cve #cwe-276

漏洞预警2026-06-22 发布INFO

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer...

CVE-2026-10601

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL path

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-22 发布INFO

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration ...

CVE-2025-66389

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler

历史摘要 · 未重新核验 · NVD

#cve #cwe-552