2026-06-27 归档

今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。

← 返回归档列表

漏洞预警2026-06-26 发布INFO

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 2...

CVE-2026-48928

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-26 发布INFO

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability aff...

CVE-2026-48619

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-06-26 发布INFO

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostna...

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-06-26 发布INFO

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they ...

CVE-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. Wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-06-26 发布INFO

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and incl...

CVE-2026-13226

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-26 发布INFO

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This cou...

CVE-2026-9222

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-836

漏洞预警2026-06-26 发布INFO

The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mob...

CVE-2026-9221

The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request si

历史摘要 · 未重新核验 · NVD

#cve #cwe-327

漏洞预警2026-06-26 发布INFO

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initializat...

CVE-2026-9220

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and i

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-06-26 发布INFO

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authe...

CVE-2026-9219

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derive

历史摘要 · 未重新核验 · NVD

#cve #cwe-340

漏洞预警2026-06-26 发布INFO

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible wit...

CVE-2026-43920

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patch

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-06-26 发布INFO

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a...

CVE-2026-13322

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Re

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-06-26 发布INFO

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-a...

CVE-2026-13318

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-26 发布INFO

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without ...

CVE-2026-13218

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a laun

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-06-26 发布INFO

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administ...

CVE-2026-13083

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper es

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-26 发布INFO

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SE...

CVE-2026-12993

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but d

历史摘要 · 未重新核验 · NVD

#cve #cwe-776

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed p...

CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import sign

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing...

CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At lin...

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. sess...

CVE-2026-40082

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regen

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-06-25 发布INFO

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check ...

CVE-2026-40080

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Red

历史摘要 · 未重新核验 · NVD

#cve #cwe-601