2026-07-10 归档

今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-07-09 发布INFO

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed ...

CVE-2026-49274

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with role

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-09 发布INFO

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values i...

CVE-2026-13492

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-09 发布INFO

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed ...

CVE-2025-63579

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The secu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284 #cwe-311 #cwe-326

漏洞预警2026-07-09 发布INFO

The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sen...

CVE-2026-61344

The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-07-09 发布INFO

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator creden...

CVE-2026-61343

LibreBooking's email template editor save action passes the submitted template name directly into the destination file p

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-09 发布INFO

Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control donation checkout m...

CVE-2026-59817

Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed a

历史摘要 · 未重新核验 · NVD

#cve #cwe-472 #cwe-639

漏洞预警2026-07-09 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php gene...

CVE-2026-59734

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-09 发布INFO

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAIL...

CVE-2026-59721

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78 #cwe-915

漏洞预警2026-07-09 发布INFO

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema....

CVE-2026-59720

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-07-09 发布INFO

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim...

CVE-2026-58378

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB a

历史摘要 · 未重新核验 · NVD

#cve #cwe-489

漏洞预警2026-07-09 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could b...

CVE-2026-55420

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-09 发布INFO

An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the ...

CVE-2026-43752

An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicio

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-09 发布INFO

A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation...

CVE-2026-15202

A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzm

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-07-09 发布INFO

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a mani...

CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Po

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1321

漏洞预警2026-07-09 发布INFO

Rejected reason: After further coordination, CVE was determined to not be warranted.

CVE-2026-14278

Rejected reason: After further coordination, CVE was determined to not be warranted.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The...

CVE-2026-59715

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Soc

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and di...

CVE-2026-59227

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without recheckin...

CVE-2026-59226

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862 #cwe-863

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wra...

CVE-2026-59225

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against UR...

CVE-2026-59223

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_

历史摘要 · 未重新核验 · NVD

#cve #cwe-693