2026-06-25 归档

今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-06-23 发布INFO

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating sy...

CVE-2026-54328

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension packa

历史摘要 · 未重新核验 · NVD

#cve #cwe-379

漏洞预警2026-06-23 发布INFO

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdow...

CVE-2026-54326

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-23 发布INFO

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and dec...

CVE-2026-54320

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-863

漏洞预警2026-06-23 发布INFO

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also ...

CVE-2026-54319

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-250 #cwe-269

漏洞预警2026-06-23 发布INFO

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS ...

CVE-2026-54323

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-06-23 发布INFO

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with...

CVE-2026-54318

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-926

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the ydoc:document:join Socket.IO handler checks note ownershi...

CVE-2026-54022

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-706 #cwe-863

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the pr...

CVE-2026-54015

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache fi...

CVE-2026-54014

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id...

CVE-2026-54010

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639 #cwe-862

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that...

CVE-2026-54009

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-23 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_picture_url calls ...

CVE-2026-54008

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backe

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-23 发布INFO

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re...

CVE-2026-49859

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the des

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-918

漏洞预警2026-06-23 发布INFO

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options...

CVE-2026-49440

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][,

历史摘要 · 未重新核验 · NVD

#cve #cwe-325

漏洞预警2026-06-23 发布INFO

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit applicat...

CVE-2026-44726

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatib

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-06-23 发布INFO

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected wit...

CVE-2026-0864

When using the "configparser" module to write configuration files containing multi-line text values with carriage return

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-06-23 发布INFO

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that could result in arbi...

CVE-2020-9695

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-06-23 发布INFO

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged a...

CVE-2026-56117

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handl

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-23 发布INFO

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated sam...

CVE-2026-56114

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_mak

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-06-23 发布INFO

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication t...

CVE-2026-55446

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /

历史摘要 · 未重新核验 · NVD

#cve #cwe-400