SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

CVE-2026-10667

Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-l

历史摘要 · 未重新核验 · OSV.dev

Flowise - Weak Default JWT Secrets in Authentication Middleware

CVE-2026-56271

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refr

历史摘要 · 未重新核验 · OSV.dev

Crawl4AI - Arbitrary File Write via output_path Parameter

CVE-2026-56261 · CVE-2026-56262 · CVE-2026-56263 · CVE-2026-56264 · CVE-2026-56265 · CVE-2026-56266 · CVE-2026-56260

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf end

历史摘要 · 未重新核验 · OSV.dev

Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

CVE-2026-56259

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to

历史摘要 · 未重新核验 · OSV.dev

Capgo - Scope Isolation Failure in Webhook Test Endpoint

CVE-2026-56252

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scope

历史摘要 · 未重新核验 · OSV.dev

Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right

CVE-2026-56241

Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to del

历史摘要 · 未重新核验 · OSV.dev

Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint

CVE-2026-56238

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint t

历史摘要 · 未重新核验 · OSV.dev

hcr707305003 shiroiAdmin FileController.php upload unrestricted upload

CVE-2026-15488

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of t

历史摘要 · 未重新核验 · OSV.dev

IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection

CVE-2026-15478

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports

历史摘要 · 未重新核验 · OSV.dev

Bahmni bahmnicore Search Endpoint sql additionalParams sql injection

CVE-2026-15477

A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /op

历史摘要 · 未重新核验 · OSV.dev

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AW...

CVE-2026-15508

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file

历史摘要 · 未重新核验 · NVD

The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_e...

CVE-2026-10668

The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage

历史摘要 · 未重新核验 · NVD

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-58596

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges o

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org/cloud/sonic/contr...

CVE-2026-15497

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file so

历史摘要 · 未重新核验 · NVD

Compatibility Test Suite (CTS)

该公告来自 Android 安全公告，内容涉及兼容性测试套件 (CTS)。CTS 是 Android 为确保设备兼容性而提供的测试工具集，用于验证设备是否符合 Android 兼容性定义文档 (CDD) 的要求。本次公告未提及具体的安全漏洞

历史摘要 · 未重新核验 · Android Security Bulletin

Compatibility Definition Document (CDD)

Android兼容性定义文档（Compatibility Definition Document, CDD）是Android生态系统的核心规范文件，定义了设备必须满足的硬件和软件要求，以确保应用兼容性。该文档并非安全公告，不包含任何CVE漏

历史摘要 · 未重新核验 · Android Security Bulletin

Tools, build, and related reference

Android安全公告中发布的“工具、构建及相关参考”文档，主要面向开发者和安全研究人员，提供Android系统构建、编译工具链及参考资料。该文档本身不涉及具体安全漏洞或补丁，但作为官方参考资源，有助于理解Android安全更新流程及构建环

历史摘要 · 未重新核验 · Android Security Bulletin

Latest Compatibility Definition Document (CDD)

该公告是 Android 安全公告中的最新兼容性定义文档（CDD）更新。CDD 是 Android 生态系统的核心文档，定义了设备必须满足的软硬件兼容性要求，以确保应用在不同设备上的一致运行体验。本次更新可能涉及新的 API 要求、安全功能

历史摘要 · 未重新核验 · Android Security Bulletin

Latest security bulletins

Android安全公告于2026年7月13日发布，但输入中未提供具体的漏洞列表或严重性评级。该公告通常包含影响Android系统组件（如框架、内核、媒体框架等）的安全补丁。由于缺乏细节，无法确定具体的受影响组件和漏洞严重程度。建议用户密切关

历史摘要 · 未重新核验 · Android Security Bulletin

update the software on your Mac

Apple 发布了针对 Mac 的安全更新公告，建议用户更新 Mac 上的软件。公告中未提供具体的漏洞详情、影响的产品列表或严重等级。该更新旨在修复潜在的安全问题，因此所有 Mac 用户应尽快应用更新以确保系统安全。

历史摘要 · 未重新核验 · Apple Security Releases