2026-06-27 归档

今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-06-26 发布INFO

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directo...

CVE-2026-55686

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-06-26 发布INFO

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a proce...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mo

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-cr...

CVE-2026-45407

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch comm

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then in...

CVE-2026-45406

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-i

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing...

CVE-2026-45405

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/z

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-06-26 发布INFO

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_i...

CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-26 发布INFO

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value i...

CVE-2026-13434

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multu

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-26 发布INFO

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

CVE-2026-11779

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-06-26 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in Extra...

CVE-2025-32423

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-26 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in AITex...

CVE-2025-32394

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-405 #cwe-770

漏洞预警2026-06-26 发布INFO

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies durin...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 reg

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-26 发布INFO

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to ca...

CVE-2026-9639

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-06-26 发布INFO

Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially...

CVE-2026-5757

Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-26 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI a...

CVE-2026-47214

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-400

漏洞预警2026-06-26 发布INFO

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for...

CVE-2026-45195

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memor

历史摘要 · 未重新核验 · NVD

#cve #cwe-280

漏洞预警2026-06-26 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's X...

CVE-2026-44018

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

#cve #cwe-409 #cwe-611 #cwe-776

漏洞预警2026-06-26 发布INFO

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume ...

CVE-2026-12411

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, r

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-06-26 发布INFO

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected...

CVE-2026-0828

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unpr

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-26 发布INFO

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of...

CVE-2023-20572

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against th

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-06-26 发布INFO

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary me...

CVE-2023-20540

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against th

历史摘要 · 未重新核验 · NVD

#cve #cwe-208