2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

漏洞预警2026-07-08 发布INFO

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.

CVE-2026-57238

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid...

CVE-2026-57237

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the under

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code wi...

CVE-2026-56001

A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-08 发布INFO

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to C...

CVE-2026-56000

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland b

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via Set...

CVE-2026-55999

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland b

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-08 发布INFO

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing ...

CVE-2026-13129

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually lea...

CVE-2026-13128

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnail...

CVE-2026-13127

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, result...

CVE-2026-13126

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-08 发布INFO

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowi...

CVE-2026-12378

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data be

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-08 发布INFO

The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validati...

CVE-2026-9731

The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-08 发布INFO

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on t...

CVE-2026-9700

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrar...

CVE-2026-57895

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executa

历史摘要 · 未重新核验 · NVD

#cve #cwe-276

漏洞预警2026-07-08 发布INFO

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer ...

CVE-2026-56437

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-07-08 发布INFO

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() A...

CVE-2026-14500

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and i

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists ...

CVE-2026-14495

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-338

漏洞预警2026-07-08 发布INFO

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including,...

CVE-2026-14489

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-08 发布INFO

The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a...

CVE-2026-12097

The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-08 发布INFO

The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due...

CVE-2026-12041

The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-08 发布INFO

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share...

CVE-2026-11798

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Refle

历史摘要 · 未重新核验 · NVD

#cve #cwe-79