2026-07-10 归档

今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-07-10 发布HIGH

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IP...

CVE-2026-54423

CVE-2026-54423 是 OpenStack Ironic 组件中的一个高危漏洞，影响版本 37.0.1 之前。OpenStack Ironic 是用于裸金属服务器部署与管理的开源项目，支持通过 IPMI（智能平台管理接口）等协议远

历史摘要 · 未重新核验 · NVD

#cve #cwe-424

漏洞预警2026-07-10 发布MEDIUM

OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.

CVE-2026-44918

OpenStack Ironic存在授权缺陷，影响版本至37.0.1之前。攻击者（需具备项目管理员权限）可在没有适当授权的情况下跨项目创建或修改节点。该漏洞允许高权限用户（PR:H）通过网络远程利用（AV:N），无需用户交互（UI:N），攻

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-10 发布HIGH

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing o...

CVE-2026-15070

WordPress 插件 Salon Booking System – Free Version（版本 <= 10.30.32）存在跨站请求伪造（CSRF）漏洞，该漏洞源于 setCustomText 函数缺少或错误的 nonce 验证。攻

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-10 发布HIGH

The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure funct...

CVE-2026-13430

WordPress 插件 Post Export Import with Media 版本 1.13.1 及以下存在任意文件上传漏洞。漏洞源于 ajax_import_media_start() 函数在处理 ZIP 文件条目时，使用 pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-10 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-49757. Reason: This candidate is a duplicate of CVE-2026-49757. Notes: All CVE users should ...

CVE-2026-55616

CVE-2026-55616 已被 NVD 拒绝，原因是该编号与 CVE-2026-49757 重复。根据拒绝说明，所有用户应参考 CVE-2026-49757 而非此编号。该 CVE 没有提供任何受影响产品、厂商或 CVSS 评分，因此不

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-10 发布CRITICAL

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j...

CVE-2026-55615

Langroid是一个用于构建大语言模型（LLM）应用的框架。在版本0.65.5之前，其Neo4jChatAgent组件存在严重安全漏洞。该组件将LLM生成的Cypher查询直接传递给Neo4j驱动程序，未进行任何验证、语句类型白名单或退出

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-07-10 发布INFO

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth ...

CVE-2026-50180

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent`

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-89

漏洞预警2026-07-10 发布INFO

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go ...

CVE-2026-15317

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFe

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-10 发布INFO

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the login...

CVE-2026-12598

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-10 发布INFO

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in...

CVE-2026-12597

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-10 发布INFO

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in ...

CVE-2026-12595

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all version

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-09 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extensi...

CVE-2026-59858

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/cco

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-09 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL s...

CVE-2026-59857

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in s

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-09 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken ...

CVE-2026-59856

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/p

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-09 发布INFO

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution bec...

CVE-2026-59831

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-07-09 发布INFO

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link UR...

CVE-2026-57501

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-07-09 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked thr...

CVE-2026-59828

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-09 发布INFO

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supp...

CVE-2026-58144

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-09 发布INFO

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a lo...

CVE-2026-58143

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-09 发布INFO

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based atta...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS o

历史摘要 · 未重新核验 · NVD

#cve #cwe-706