2026-07-02 归档

今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-01 发布INFO

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested...

CVE-2026-54592

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-787

漏洞预警2026-07-01 发布INFO

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a lar...

CVE-2026-54502

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-07-01 发布INFO

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, fo...

CVE-2026-54500

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-908

漏洞预警2026-06-30 发布INFO

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to grou...

CVE-2026-57995

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GR

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-06-30 发布INFO

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to cre...

CVE-2026-56777

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Pytho

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-06-30 发布INFO

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protec...

CVE-2026-56399

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass pat...

CVE-2026-56377

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in ...

CVE-2026-56369

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to A

历史摘要 · 未重新核验 · NVD

#cve #cwe-323

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memor...

CVE-2026-56365

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers c

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed dev...

CVE-2026-56364

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a la...

CVE-2026-56363

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-06-30 发布INFO

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providi...

CVE-2026-56361

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-30 发布INFO

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases ar...

CVE-2026-56356

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfigu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-30 发布INFO

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password...

CVE-2026-56350

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Att...

CVE-2026-56334

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and ano

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security p...

CVE-2026-56333

Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is in...

CVE-2026-56331

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly ...

CVE-2026-56328

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unn

历史摘要 · 未重新核验 · NVD

#cve #cwe-670

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organizat...

CVE-2026-56327

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-06-30 发布INFO

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app'...

CVE-2026-56320

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_i

历史摘要 · 未重新核验 · NVD

#cve #cwe-285