2026-07-11 归档

今日共收录 1315 条安全情报，包含 488 个 CVE，410 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-07-10 发布INFO

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, ...

CVE-2026-55806

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versio...

CVE-2026-55804

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versio...

CVE-2026-55803

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in in...

CVE-2026-55187

Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-10 发布INFO

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed ...

CVE-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the

历史摘要 · 未重新核验 · NVD

#cve #cwe-208 #cwe-347

漏洞预警2026-07-10 发布INFO

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache ...

CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not...

CVE-2026-49394

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_pag

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-10 发布INFO

TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified addr...

CVE-2026-49213

TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHtt

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints...

CVE-2026-48127

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. Th...

CVE-2026-47422

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked approp

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self...

CVE-2026-47199

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT I

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-10 发布INFO

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization ...

CVE-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-470 #cwe-502

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed i...

CVE-2026-42219

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Ch...

CVE-2026-41482

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion wer

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO...

CVE-2026-15085

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-10 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects...

CVE-2026-15084

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affect...

CVE-2026-15083

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Cond

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue ...

CVE-2026-15082

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-10 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location ...

CVE-2026-15081

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Se

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-10 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: f...

CVE-2026-15080

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery.

历史摘要 · 未重新核验 · NVD

#cve #cwe-352