2026-06-27 归档

今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's T...

CVE-2026-48706

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured ...

CVE-2026-48497

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-480

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identifie...

CVE-2026-48044

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack o...

CVE-2026-48042

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-1124

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultC...

CVE-2026-47778

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-158

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt()...

CVE-2026-47775

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-209 #cwe-327

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator ...

CVE-2026-47692

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-130

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null p...

CVE-2026-47221

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server...

CVE-2026-47207

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-26 发布INFO

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats f...

CVE-2026-47204

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-06-26 发布INFO

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path ...

CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decodi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-26 发布INFO

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On...

CVE-2026-21734

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-

历史摘要 · 未重新核验 · NVD

#cve #cwe-823

漏洞预警2026-06-26 发布INFO

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

CVE-2026-57635

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-06-26 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.

CVE-2026-56048

Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <=

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-26 发布INFO

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVE-2026-56029

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-06-25 发布INFO

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4....

CVE-2026-46608

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s)

历史摘要 · 未重新核验 · NVD

#cve #cwe-183 #cwe-942

漏洞预警2026-06-25 发布INFO

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAu...

CVE-2026-54573

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess fun

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

威胁情报2026-06-26 发布INFO

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

CVE-2026-12957

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credent

历史摘要 · 未重新核验 · The Hacker News

#thn #cybersecurity #news

漏洞预警2026-06-26 发布CRITICAL

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request ...

CVE-2026-53576

Kestra 是一个开源、事件驱动的工作流编排平台。在版本 1.0.45 和 1.3.21 之前，REST API 的认证过滤器（@Filter("/api/v1/**")）会将任何以 /configs 结尾的请求视为公共的 instanc

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-288

漏洞预警2026-06-26 发布CRITICAL

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whit...

CVE-2026-49869

Kestra 是一个开源事件驱动编排平台。在 1.0.45 和 1.3.21 版本之前，其 AuthenticationFilter 使用 request.getPath().endsWith("/configs") 来将公开配置端点列入

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-184 #cwe-287 #cwe-918 #authentication-bypass