2026-06-26 归档

今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-25 发布INFO

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to a...

CVE-2026-56445

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-25 发布INFO

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.

CVE-2026-57700

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This i

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-06-25 发布INFO

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191...

CVE-2026-56786

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp lengt

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-06-25 发布INFO

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrows...

CVE-2026-54089

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290

漏洞预警2026-06-25 发布INFO

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

CVE-2026-54849

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-25 发布INFO

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

CVE-2026-54843

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-25 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a t...

CVE-2026-54836

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-25 发布INFO

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

CVE-2026-54823

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-25 发布INFO

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with rem...

CVE-2026-41120

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trust

历史摘要 · 未重新核验 · NVD

#cve #cwe-349

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_comma...

CVE-2026-40079

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-06-24 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in grap...

CVE-2026-39955

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQ

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-24 发布INFO

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather t...

CVE-2026-39948

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-24 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardenin...

CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-78

漏洞预警2026-06-24 发布INFO

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default ...

CVE-2026-55454

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-749 #cwe-1188

漏洞预警2026-06-24 发布INFO

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without s...

CVE-2026-39893

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request va

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-24 发布INFO

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them a...

CVE-2026-52813

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-06-24 发布INFO

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request ...

CVE-2026-52806

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-06-24 发布INFO

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated net...

CVE-2026-45689

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-06-24 发布INFO

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS logi...

CVE-2026-45688

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-06-24 发布INFO

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visit...

CVE-2026-53943

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that resul

历史摘要 · 未重新核验 · NVD

#cve #cwe-524