2026-07-12 归档

今日共收录 877 条安全情报，包含 71 个 CVE，468 篇安全通告，以及 78 篇研究论文。

漏洞预警2026-07-11 发布LOW

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with s...

CVE-2026-61857

CVE-2026-61857 是 ImageMagick 软件中的一个堆释放后使用漏洞，影响版本 7.1.2-26 之前的版本。该漏洞源于 ImageMagick 在解析 XMP（可扩展元数据平台）配置文件时，未对指针进行空值检查，导致在处

历史摘要 · 未重新核验 · NVD

#cve #cwe-252

漏洞预警2026-07-11 发布MEDIUM

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and ...

CVE-2026-61454

CVE-2026-61454 影响 Grav Admin2 插件 (getgrav/grav-plugin-admin2) 版本 2.0.4 之前。该插件在 Admin2 SPA 引导页面 (/grav/admin 及其子路由) 中嵌入了一

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-11 发布HIGH

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspac...

CVE-2026-61442

CVE-2026-61442 影响 PraisonAI Platform 0.1.9 之前的版本。该平台在项目、问题和代理的 PATCH 路由上未正确实施所有者/管理员授权检查，仅要求用户具备工作空间成员角色即可发起修改请求。这意味着任意工

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-11 发布HIGH

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass...

CVE-2026-61439

PraisonAI 版本 4.6.78 之前存在提示注入防御配置错误。默认情况下，阻止阈值设置为严重（CRITICAL）级别，导致高（HIGH）严重级别的威胁可以绕过。攻击者可以提交单向量提示注入攻击，例如指令覆盖或金融操控，这些攻击会触发

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-07-11 发布INFO

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiti...

CVE-2026-61429

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend th

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-11 发布INFO

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Atta...

CVE-2026-61428

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-07-11 发布INFO

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call ...

CVE-2026-61426

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requireme

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-11 发布INFO

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path tr...

CVE-2026-60088

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read f

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-11 发布INFO

Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When par...

CVE-2026-56763

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field na

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-07-11 发布INFO

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:me...

CVE-2026-56372

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-11 发布INFO

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. U...

CVE-2026-56303

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function m

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-11 发布INFO

Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-exis...

CVE-2026-56296

Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that ret

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-07-11 发布INFO

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grant...

CVE-2026-56240

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows o

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-07-11 发布INFO

The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

CVE-2026-57828

The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered user

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-11 发布INFO

The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

CVE-2026-57827

The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-11 发布INFO

The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() func...

CVE-2026-1359

The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-11 发布INFO

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible fo...

CVE-2026-9282

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-11 发布INFO

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the pl...

CVE-2026-9017

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-11 发布INFO

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it ...

CVE-2026-6801

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-11 发布INFO

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions ...

CVE-2026-4661

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQ

历史摘要 · 未重新核验 · NVD

#cve #cwe-89