2026-06-25 归档

今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection ...

CVE-2026-47381

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise an

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-use...

CVE-2026-47380

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between

历史摘要 · 未重新核验 · NVD

#cve #cwe-208 #cwe-307

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for legacy plaintext ...

CVE-2026-47379

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-203

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path extracted from the ...

CVE-2026-47377

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin calle

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a serv...

CVE-2026-47376

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL...

CVE-2026-47375

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd perm

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying t...

CVE-2026-47279

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry expired, because the...

CVE-2026-46554

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authenticated viewers. Usin...

CVE-2026-46552

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the sam

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against...

CVE-2026-46551

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attach

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the same...

CVE-2026-46550

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with htt

历史摘要 · 未重新核验 · NVD

#cve #cwe-614

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but...

CVE-2026-46549

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_s

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook pl...

CVE-2026-46548

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protecti

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-23 发布INFO

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-5...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-23 发布INFO

A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte...

CVE-2026-12892

A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-23 发布INFO

A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser perfo...

CVE-2026-12891

A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a cra

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-23 发布INFO

Module: plugins/modules/nexmo.py CVSS 3.1: 6.5 MEDIUM — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: api_key and api_secret are declared no_log=True at the input level, but bot...

CVE-2026-11820

Module: plugins/modules/nexmo.py CVSS 3.1: 6.5 MEDIUM — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: api_key and api_se

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-06-23 发布INFO

Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS native keyring (GNOME...

CVE-2026-11819

Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-06-23 发布INFO

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vuln...

CVE-2025-64105

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online s

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-23 发布INFO

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell cons...

CVE-2026-54555

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter

历史摘要 · 未重新核验 · NVD

#cve #cwe-863