2026-06-27 归档

今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and ...

CVE-2026-44736

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639 #cwe-836

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a p...

CVE-2026-44735

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares en

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsControlle...

CVE-2026-44734

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization v

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me perm...

CVE-2026-44733

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on O

历史摘要 · 未重新核验 · NVD

#cve #cwe-620

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. ...

CVE-2026-44732

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a doc

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corres...

CVE-2026-44731

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's mee

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-26 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] fo...

CVE-2026-44696

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) r

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-26 发布INFO

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injec...

CVE-2026-32833

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-26 发布INFO

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_wi...

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-26 发布INFO

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-...

CVE-2026-54753

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local H

历史摘要 · 未重新核验 · NVD

#cve #cwe-749 #cwe-942

漏洞预警2026-06-26 发布INFO

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file contain

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-61

漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust de...

CVE-2026-55448

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credent

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but t...

CVE-2026-55441

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-94 #cwe-732

漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version str...

CVE-2026-54557

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its inst

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-26 发布INFO

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack ...

CVE-2026-54341

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-26 发布INFO

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializ...

CVE-2026-47206

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Proto

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-26 发布INFO

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arb...

CVE-2026-57518

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-26 发布INFO

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podm...

CVE-2026-57231

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environ

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-668

漏洞预警2026-06-26 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integrations/webhooks/{webho...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639

漏洞预警2026-06-26 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the ...

CVE-2026-56663

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-918