2026-07-02 归档

今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-01 发布INFO

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'nin...

CVE-2026-1239

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-01 发布INFO

DVP80ES300T with Improper Validation of Array Index Vulnerability

CVE-2026-14193

DVP80ES300T with Improper Validation of Array Index Vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-07-01 发布INFO

AS228T with Authentication Bypass Vulnerability

CVE-2026-12579

AS228T with Authentication Bypass Vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-07-01 发布INFO

The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subsc...

CVE-2026-11887

The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows ...

CVE-2026-11883

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authent

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low...

CVE-2026-11880

The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription canc

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() func...

CVE-2026-11823

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-01 发布INFO

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form ...

CVE-2026-11794

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cr...

CVE-2026-11570

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through ...

CVE-2026-11568

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level acces...

CVE-2026-11562

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions,

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a...

CVE-2026-10750

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-01 发布INFO

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the fil...

CVE-2025-15666

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerabili

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-122

漏洞预警2026-07-01 发布INFO

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in a...

CVE-2026-9107

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.c...

CVE-2026-7838

UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failu

历史摘要 · 未重新核验 · NVD

#cve #cwe-190 #cwe-787

漏洞预警2026-07-01 发布INFO

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied n...

CVE-2026-7831

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In v

历史摘要 · 未重新核验 · NVD

#cve #cwe-193 #cwe-787

漏洞预警2026-07-01 发布INFO

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies...

CVE-2026-7829

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In r

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-01 发布INFO

UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes v...

CVE-2026-7828

UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/sett

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-01 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. Th...

CVE-2026-58519

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawik...

CVE-2026-58518

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-352