2026-07-01 归档

今日共收录 1573 条安全情报，包含 770 个 CVE，406 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in ...

CVE-2026-56369

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to A

历史摘要 · 未重新核验 · NVD

#cve #cwe-323

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memor...

CVE-2026-56365

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers c

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed dev...

CVE-2026-56364

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a la...

CVE-2026-56363

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providi...

CVE-2026-56361

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-30 发布INFO

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases ar...

CVE-2026-56356

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfigu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-30 发布INFO

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password...

CVE-2026-56350

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Att...

CVE-2026-56334

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and ano

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security p...

CVE-2026-56333

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is in...

CVE-2026-56331

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly ...

CVE-2026-56328

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unn

历史摘要 · 未重新核验 · NVD

#cve #cwe-670

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organizat...

CVE-2026-56327

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app'...

CVE-2026-56320

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_i

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed...

CVE-2026-56318

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosu...

CVE-2026-56300

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey th

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verif...

CVE-2026-56286

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows delet

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-06-30 发布INFO

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech...

CVE-2026-56277

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-06-30 发布INFO

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplie...

CVE-2026-56264

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js en

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing t...

CVE-2026-56249

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pr...

CVE-2026-56247

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compa

历史摘要 · 未重新核验 · NVD

#cve #cwe-266