2026-06-25 归档

今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-24 发布INFO

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to...

CVE-2026-57284

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated thro

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-06-24 发布INFO

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or syste...

CVE-2026-57283

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-06-24 发布INFO

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers ab...

CVE-2026-57282

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded i

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-24 发布INFO

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run...

CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carr

历史摘要 · 未重新核验 · NVD

#cve #cwe-93 #cwe-693

漏洞预警2026-06-24 发布INFO

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scri...

CVE-2026-57280

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-06-24 发布INFO

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses `sscanf` with `%s` into 64-byte stack buffer...

CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.c

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-06-24 发布INFO

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing pa...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-06-24 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-29034

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-24 发布INFO

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.2...

CVE-2026-12537

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1)

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-24 发布INFO

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Att...

CVE-2026-56761

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to injec

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-24 发布INFO

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Att...

CVE-2026-56370

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-24 发布INFO

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigg...

CVE-2026-56368

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-06-24 发布INFO

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sani...

CVE-2026-56358

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-24 发布INFO

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through une...

CVE-2026-56351

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-24 发布INFO

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha valid...

CVE-2026-56338

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-703

漏洞预警2026-06-24 发布INFO

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumerate app_ids by call...

CVE-2026-56337

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-24 发布INFO

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limited_to_orgs restri...

CVE-2026-56310

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-24 发布INFO

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icon...

CVE-2026-56302

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-24 发布INFO

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password...

CVE-2026-56272

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recom

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-06-24 发布INFO

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retri...

CVE-2026-56270

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginm

历史摘要 · 未重新核验 · NVD

#cve #cwe-306