2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

← 返回归档列表

漏洞预警2026-07-08 发布INFO

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 20...

CVE-2026-8651

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-07-08 发布INFO

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CVE-2026-8650

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Tr

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-08 发布INFO

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2...

CVE-2026-8649

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-07-08 发布INFO

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organi...

CVE-2026-60104

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-08 发布INFO

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private...

CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-787

漏洞预警2026-07-08 发布INFO

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the us...

CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-08 发布INFO

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package insta...

CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-732

漏洞预警2026-07-08 发布INFO

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzi...

CVE-2026-59939

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression o

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-07-08 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causin...

CVE-2026-59936

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page conten

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-08 发布INFO

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that us...

CVE-2026-59935

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page conten

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-07-08 发布INFO

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSa...

CVE-2026-59807

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-07-08 发布INFO

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSR...

CVE-2026-59806

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to re

历史摘要 · 未重新核验 · NVD

#cve #cwe-601 #cwe-918

漏洞预警2026-07-08 发布INFO

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other s...

CVE-2026-59805

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-08 发布INFO

Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote atta...

CVE-2026-59804

Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfigurat

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-1385

漏洞预警2026-07-08 发布INFO

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag...

CVE-2026-59803

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (prot

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-07-08 发布INFO

PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes contain...

CVE-2026-59802

PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_ur

历史摘要 · 未重新核验 · NVD

#cve #cwe-183

漏洞预警2026-07-08 发布INFO

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, x...

CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-08 发布INFO

Rejected reason: Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vu...

CVE-2026-58212

Rejected reason: Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updati

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-08 发布INFO

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTem...

CVE-2026-55760

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass us

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its ...

CVE-2026-55575

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filt

历史摘要 · 未重新核验 · NVD

#cve #cwe-770