2026-06-25 归档

今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-23 发布INFO

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smar...

CVE-2026-56785

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-23 发布INFO

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export fu...

CVE-2026-47693

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-06-23 发布INFO

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the teto...

CVE-2026-12164

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or el

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-06-23 发布INFO

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI co...

CVE-2026-12163

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-23 发布INFO

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

CVE-2026-11972

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly h

历史摘要 · 未重新核验 · NVD

#cve #cwe-252 #cwe-606 #cwe-770

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler....

CVE-2026-54518

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-23 发布INFO

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs ses...

CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._dese...

CVE-2026-54517

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._...

CVE-2026-54516

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializ...

CVE-2026-54515

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphic...

CVE-2026-54513

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind...

CVE-2026-54512

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-502

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the...

CVE-2026-53931

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequ

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-918

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced ...

CVE-2026-53930

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted e...

CVE-2026-53927

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequ

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exist...

CVE-2026-50193

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in Noc...

CVE-2026-47387

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (pack

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitr...

CVE-2026-47385

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint ...

CVE-2026-47384

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without re...

CVE-2026-47382

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw

历史摘要 · 未重新核验 · NVD

#cve #cwe-918