2026-07-08 归档

今日共收录 1050 条安全情报，包含 282 个 CVE，378 篇安全通告，以及 103 篇研究论文。

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin AP...

CVE-2026-53643

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged st

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639 #cwe-862

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in c...

CVE-2026-53642

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing...

CVE-2026-53641

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cros

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-838

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints th...

CVE-2026-53640

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

漏洞预警2026-07-06 发布INFO

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID att...

CVE-2026-59710

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/ta

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN...

CVE-2026-43928

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment

历史摘要 · 未重新核验 · NVD

#cve #cwe-754 #cwe-1284

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to app...

CVE-2026-43927

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration...

CVE-2026-43925

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPr...

CVE-2026-43921

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code i

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing a...

CVE-2026-43918

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAN...

CVE-2026-42204

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attac...

CVE-2026-42153

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings...

CVE-2026-42148

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate li...

CVE-2026-41899

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-770

漏洞预警2026-07-06 发布INFO

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-06 发布INFO

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.

CVE-2026-38976

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missi

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-07-06 发布INFO

mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().

CVE-2026-38973

mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerab...

CVE-2026-34599

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a pub...

CVE-2026-34167

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-06 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell co...

CVE-2026-34153

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78