2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

← 返回归档列表

漏洞预警2026-07-08 发布INFO

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated...

CVE-2026-56273

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Atta...

CVE-2026-56250

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST,

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permis...

CVE-2026-56246

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped A

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-07-08 发布INFO

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowin...

CVE-2026-56226

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attacker...

CVE-2026-56220

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows re

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted s...

CVE-2026-56217

Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped A

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-08 发布INFO

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release ...

CVE-2026-56086

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-08 发布INFO

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release ...

CVE-2026-53482

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-08 发布INFO

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release ...

CVE-2026-53480

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) inje...

CVE-2026-44840

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-07-08 发布INFO

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release ...

CVE-2026-41122

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

CVE-2026-22927

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

Tanium addressed a denial of service vulnerability in Tanium Server.

CVE-2026-15053

Tanium addressed a denial of service vulnerability in Tanium Server.

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-07-08 发布INFO

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Na...

CVE-2026-15035

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-77

漏洞预警2026-07-08 发布INFO

A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-s...

CVE-2026-15034

A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

漏洞预警2026-07-08 发布INFO

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of ...

CVE-2026-15033

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-07-08 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS. This issue affects Medi...

CVE-2026-8315

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Desig

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Reflected XSS. This issue affects M...

CVE-2026-8310

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Desig

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8...

CVE-2026-6820

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ema

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all ...

CVE-2026-6740

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79