2026-07-08 归档

今日共收录 1050 条安全情报，包含 282 个 CVE，378 篇安全通告，以及 103 篇研究论文。

漏洞预警2026-07-07 发布INFO

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Ta...

CVE-2026-7380

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Techno

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-07-07 发布INFO

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue af...

CVE-2026-5799

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue af...

CVE-2026-5730

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

CVE-2026-58315

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-07 发布INFO

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: t...

CVE-2026-57871

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overw

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-07 发布INFO

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. Thi...

CVE-2026-57870

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document template

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlo...

CVE-2026-57869

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-1241

漏洞预警2026-07-07 发布INFO

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.

CVE-2026-57868

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects M

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute...

CVE-2026-57867

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit a

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-07-07 发布INFO

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticate...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input bef

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-07 发布INFO

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated us...

CVE-2026-10834

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile ima

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_pa...

CVE-2026-42201

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled c...

CVE-2026-34158

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-07 发布INFO

Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart ...

CVE-2026-27844

Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-07-07 发布INFO

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denia...

CVE-2026-27790

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-07-07 发布INFO

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that t...

CVE-2026-26053

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scri...

CVE-2026-42200

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked...

CVE-2026-42172

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL forma...

CVE-2026-42147

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/Uploa...

CVE-2026-42145

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-434 #cwe-770