SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow...
CVE-2026-44745
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurati
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files...
CVE-2026-0487
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability...
CVE-2026-62328
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v...
CVE-2026-39042
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent...
CVE-2026-26396
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/applicati
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types.
该论文提出并实现了 NYX，一种针对超管理器（Hypervisor/VMM）的高性能、覆盖引导的模糊测试工具。超管理器负责隔离同一物理机上不同虚拟机（VM）的安全边界，恶意用户若能在云 VM 上运行自己的内核，则可攻击大量攻击面，一旦利用成
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to cr...
CVE-2026-44745
SAP Approuter 在特定配置下，对 OAuth2 登录流程中的传入请求头验证不充分，导致未经身份验证的远程攻击者可构造恶意链接。受害者点击该链接后，攻击者可获得未授权访问，从而对应用程序的机密性和完整性造成高影响，但不影响可用性。
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors...
CVE-2026-44747
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management t
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious...
CVE-2026-44752
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts...
CVE-2026-44759
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url...
CVE-2026-62240
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that...
CVE-2026-62197
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that...
CVE-2026-62242
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated a
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or...
CVE-2026-14906
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within t
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows...
CVE-2026-49969
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
CVE-2026-61667
### Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query con
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
CVE-2026-55372
## Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by s
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
CVE-2026-54064
## Summary Two filter-bypass techniques in `NukeViet\Core\Request::filterAttr()` and `NukeViet\Core\Request::unhtmlenti