2026-07-09 归档

今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whos...

CVE-2026-53751

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation l

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validatio...

CVE-2026-53730

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delet...

CVE-2026-53729

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add b...

CVE-2026-53511

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the li...

CVE-2026-50530

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface onl

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before valid...

CVE-2026-50529

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-07 发布INFO

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-onl...

CVE-2026-50007

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-07 发布INFO

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticate...

CVE-2026-49471

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-352

漏洞预警2026-07-07 发布INFO

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and doe...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-07-07 发布INFO

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format...

CVE-2026-46672

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in pac

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-07-07 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized use...

CVE-2026-44454

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-07 发布INFO

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HT...

CVE-2026-58468

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-07 发布INFO

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Lo...

CVE-2026-7017

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-07-07 发布INFO

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full ...

CVE-2026-59708

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeU

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-07 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge pro...

CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-07 发布INFO

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVE-2026-48958

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-07 发布INFO

An improper access check allows unauthorized users to access com_privacy datasets.

CVE-2026-48957

An improper access check allows unauthorized users to access com_privacy datasets.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-07 发布INFO

An improper access check allows users to display a list of modules in the frontend.

CVE-2026-48956

An improper access check allows users to display a list of modules in the frontend.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-07 发布INFO

An improper access check allows unauthorized users to access workflow stage and transition information.

CVE-2026-48955

An improper access check allows unauthorized users to access workflow stage and transition information.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-07 发布INFO

Improper validation leads to a generic XSS vector in the language override feature.

CVE-2026-48954

Improper validation leads to a generic XSS vector in the language override feature.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79