2026-07-02 归档

今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-01 发布INFO

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long ...

CVE-2026-6684

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived f

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-07-01 发布INFO

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369...

CVE-2026-6683

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to b

历史摘要 · 未重新核验 · NVD

#cve #cwe-369

漏洞预警2026-07-01 发布INFO

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and uns...

CVE-2026-6682

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap,

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-01 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. Thi...

CVE-2026-6283

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Informa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. Thi...

CVE-2026-5220

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Informa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from othe...

CVE-2026-5142

A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-01 发布INFO

A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a ...

CVE-2026-5135

A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permis

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-01 发布INFO

@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() throu...

CVE-2026-58399

@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-01 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated w...

CVE-2026-58035

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated w...

CVE-2026-58034

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated w...

CVE-2026-58031

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Multiple unbounded alloca() calls in the PulseAudio protocol server.

CVE-2026-14330

Multiple unbounded alloca() calls in the PulseAudio protocol server.

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-01 发布INFO

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-07-01 发布INFO

We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment i...

CVE-2026-13602

We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-323

漏洞预警2026-07-01 发布INFO

Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a ...

CVE-2026-12374

Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-367

漏洞预警2026-07-01 发布INFO

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user...

CVE-2026-5136

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the call

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-07-01 发布INFO

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so th...

CVE-2026-53356

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during...

CVE-2026-53355

In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errat...

CVE-2026-53354

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported the warning [0] in hsr_addr_is_self(), whose...

CVE-2026-53353

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syz

历史摘要 · 未重新核验 · NVD

#cve