2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

漏洞预警2026-07-07 发布INFO

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actu...

CVE-2026-49229

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks f

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-07-07 发布INFO

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.

CVE-2026-49033

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arb

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-07-07 发布INFO

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to e...

CVE-2026-42958

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing s

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-07 发布INFO

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer....

CVE-2026-42953

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-07 发布INFO

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different or...

CVE-2026-28378

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-07 发布INFO

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endp...

CVE-2026-59707

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-07 发布INFO

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physica...

CVE-2026-58583

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege esc

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-07 发布INFO

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacke...

CVE-2026-58472

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-07 发布INFO

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to ...

CVE-2026-58471

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() f

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-07 发布INFO

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlle...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range(

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-07 发布INFO

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a mali...

CVE-2026-58469

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_s

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who ...

CVE-2026-57172

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded de

历史摘要 · 未重新核验 · NVD

#cve #cwe-321 #cwe-798

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side ...

CVE-2026-55647

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated...

CVE-2026-55635

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to uploa...

CVE-2026-55633

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and f

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName whe...

CVE-2026-55631

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-07 发布INFO

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme val...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-07 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider han...

CVE-2026-55434

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-07 发布INFO

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile H...

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user ena

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-07 发布INFO

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRed...

CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863