2026-06-26 归档

今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-25 发布INFO

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authentic...

CVE-2026-54029

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-25 发布INFO

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files...

CVE-2026-54027

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/imag

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-25 发布INFO

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The m...

CVE-2026-54025

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-25 发布INFO

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fileSize } to create...

CVE-2026-54024

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-111

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-25 发布INFO

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal s...

CVE-2026-45233

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-25 发布INFO

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a p...

CVE-2026-13351

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small num

历史摘要 · 未重新核验 · NVD

#cve #cwe-772

漏洞预警2026-06-25 发布INFO

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

CVE-2026-13350

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't b

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-25 发布INFO

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specia...

CVE-2026-9718

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-servi

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-06-25 发布INFO

CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated p...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-25 发布INFO

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when...

CVE-2026-9716

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the devi

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-06-25 发布INFO

CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an ...

CVE-2026-9651

CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-06-25 发布INFO

CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses cred...

CVE-2026-9650

CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) execute...

CVE-2026-57456

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/pytho

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO...

CVE-2026-57455

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outsid...

CVE-2026-57454

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a v

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, up...

CVE-2026-57453

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the...

CVE-2026-57452

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-191

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and return...

CVE-2026-57451

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-25 发布INFO

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced e...

CVE-2026-57438

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitutio

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-25 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dis...

CVE-2026-55895

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-94