2026-07-02 归档

今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。

← 返回归档列表

漏洞预警2026-07-01 发布INFO

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate ...

CVE-2026-50195

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-829

漏洞预警2026-07-01 发布INFO

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured ro...

CVE-2026-49119

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-01 发布INFO

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to caus...

CVE-2026-47262

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vuln

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-01 发布INFO

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker wi...

CVE-2026-41121

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Lin

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-07-01 发布INFO

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands vi...

CVE-2026-38142

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-07-01 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scr...

CVE-2026-14358

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the...

CVE-2026-13769

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-07-01 发布INFO

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version st...

CVE-2026-13760

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platfor

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-01 发布INFO

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option ...

CVE-2026-5051

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin dire

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-01 发布INFO

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. ...

CVE-2026-58521

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foun

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-01 发布INFO

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects ...

CVE-2026-58520

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener E

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-07-01 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based X...

CVE-2026-57737

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortco

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

CVE-2026-57736

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. Thi

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-07-01 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PM...

CVE-2026-57723

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal.

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-01 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enab...

CVE-2026-57722

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort...

CVE-2026-51946

SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-01 发布INFO

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted in...

CVE-2026-49091

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forgin

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-07-01 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially c...

CVE-2026-49090

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (C

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-01 发布INFO

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a...

CVE-2026-46680

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-01 发布INFO

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell...

CVE-2026-58454

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that

历史摘要 · 未重新核验 · NVD

#cve #cwe-94