2026-06-26 归档

今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-26 发布INFO

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-a...

CVE-2026-13318

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-26 发布INFO

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without ...

CVE-2026-13218

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a laun

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-06-26 发布INFO

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administ...

CVE-2026-13083

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper es

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-26 发布INFO

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SE...

CVE-2026-12993

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but d

历史摘要 · 未重新核验 · NVD

#cve #cwe-776

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed p...

CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import sign

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing...

CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At lin...

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. sess...

CVE-2026-40082

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regen

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check ...

CVE-2026-40080

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Red

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-06-25 发布INFO

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied k...

CVE-2026-8720

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a

历史摘要 · 未重新核验 · NVD

#cve #cwe-354

漏洞预警2026-06-25 发布INFO

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass a...

CVE-2026-7532

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-06-25 发布INFO

PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted.

CVE-2026-7511

PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bo

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-06-25 发布INFO

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path...

CVE-2026-6331

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-06-25 发布INFO

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's i

历史摘要 · 未重新核验 · NVD

#cve #cwe-327

漏洞预警2026-06-25 发布INFO

PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify...

CVE-2026-6329

PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and all

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-06-25 发布INFO

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer.

CVE-2026-6325

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write pas

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-06-25 发布INFO

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.

CVE-2026-6092

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing E

历史摘要 · 未重新核验 · NVD

#cve #cwe-757

漏洞预警2026-06-25 发布INFO

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The...

CVE-2026-55962

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the cl

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-06-25 发布INFO

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implement...

CVE-2026-54479

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-06-25 发布INFO

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denia...

CVE-2026-50176

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

历史摘要 · 未重新核验 · NVD

#cve #cwe-307