2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

← 返回归档列表

漏洞预警2026-07-08 发布INFO

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all...

CVE-2026-6459

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in...

CVE-2026-5459

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-08 发布INFO

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. ...

CVE-2026-5356

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-08 发布INFO

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. T...

CVE-2026-14454

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD

历史摘要 · 未重新核验 · NVD

#cve #cwe-196 #cwe-789

漏洞预警2026-07-08 发布INFO

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. Thi...

CVE-2026-12002

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-08 发布INFO

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including,...

CVE-2026-6854

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and inclu...

CVE-2026-6818

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spe

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026.1 due to insuffic...

CVE-2026-6742

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc. LimRAD NAC allows Stored XSS. This issue affects LimRA...

CVE-2026-6371

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient esca...

CVE-2026-6230

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu...

CVE-2026-3688

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-08 发布INFO

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle_frontend_register(...

CVE-2026-14250

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-08 发布INFO

The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 1....

CVE-2026-12936

The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t...

CVE-2025-14785

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for Wor

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time compar...

CVE-2026-15041

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for co

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-08 发布INFO

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be u...

CVE-2026-56003

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeSc

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-08 发布INFO

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

CVE-2026-56002

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-08 发布INFO

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Pro...

CVE-2026-6280

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consu

历史摘要 · 未重新核验 · NVD

#cve #cwe-213

漏洞预警2026-07-08 发布INFO

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and ...

CVE-2026-57260

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly re

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-08 发布INFO

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to th...

CVE-2026-57259

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-611