2026-06-27 归档

今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。

← 返回归档列表

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProject baseline compari...

CVE-2026-52785

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PAT...

CVE-2026-52782

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is ...

CVE-2026-52780

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning lea

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the def...

CVE-2026-46386

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docke

历史摘要 · 未重新核验 · NVD

#cve #cwe-502 #cwe-798 #cwe-1188 #cwe-1392

漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the...

CVE-2026-33646

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command...

CVE-2026-54636

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git re...

CVE-2026-45408

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell meta

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-26 发布INFO

Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE)...

CVE-2026-0685

Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-26 发布INFO

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `...

CVE-2025-11919

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-26 发布INFO

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

CVE-2026-57658

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

CVE-2026-56070

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

CVE-2026-56068

Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

CVE-2026-56067

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

CVE-2026-56062

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

CVE-2026-56059

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-06-26 发布INFO

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

CVE-2026-56058

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-06-26 发布INFO

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

CVE-2026-56057

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

CVE-2026-56036

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.

CVE-2026-56034

Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

CVE-2026-56033

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-266