ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
CVE-2026-58408
ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admi
2026-07-15 归档
今日共收录 995 条安全情报，包含 81 个 CVE，528 篇安全通告，以及 87 篇研究论文。
← 返回归档列表CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities
CVE-2026-55771
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisi
vsock/virtio: fix zerocopy completion for multi-skb sends
CVE-2026-53365
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
CVE-2026-53364
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_
Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
CVE-2026-61505
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthentica
Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
CVE-2026-61503
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the
Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
CVE-2026-61500
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generato
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /r...
CVE-2026-58488
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attac
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses...
CVE-2026-58487
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten(...
CVE-2026-39042
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now
CVE-2026-15410 · CVE-2026-15409
SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2
Compatibility Test Suite (CTS)
本文档来自Android安全公告，介绍了Compatibility Test Suite（CTS），即兼容性测试套件。CTS是用于验证Android设备是否符合Android兼容性定义（CDD）的工具集，确保设备能够正常运行Android应
Compatibility Definition Document (CDD)
Android兼容性定义文档（CDD）是Android开源项目（AOSP）发布的官方兼容性标准，用于定义Android设备必须满足的软硬件要求，以确保应用在不同设备间的一致性和兼容性。该文档并非安全漏洞公告，不包含任何CVE条目或特定的安全
Tools, build, and related reference
该条目源自Android安全公告（Android Security Bulletin），但内容并非常规漏洞公告，而是指向Android构建系统工具及参考资料的文档页面（https://source.android.com/docs/setu
Latest Compatibility Definition Document (CDD)
Android安全公告发布了最新的兼容性定义文档（CDD），该文档是定义Android设备必须满足的兼容性要求的官方规范。CDD涵盖了硬件、软件、API、安全性、多媒体等方面，确保应用在不同设备上具有一致的行为。此次更新可能包含对Andro
Latest security bulletins
Android安全公告（2026年7月）已发布，但公告摘要中未提供具体的漏洞详情、CVE编号或受影响产品版本。该公告通常涵盖Android平台的多项安全修复，但当前信息不足，无法进行详细技术分析。建议持续关注官方页面以获取后续补充说明。
update the software on your Mac
苹果公司于2026年7月15日发布安全公告，建议所有Mac用户更新系统软件。该公告可能涉及多个安全漏洞的修复，但未提供具体漏洞细节或CVE编号。苹果官方定期发布安全更新以修复可能被攻击者利用的漏洞，保护用户设备和数据安全。用户应及时安装更新
update the software on your iPhone or iPad
苹果公司于2026年7月15日发布了针对iPhone和iPad的安全更新公告，建议用户尽快将设备软件升级至最新版本。此类更新通常包含对已知安全漏洞的修复，攻击者可能利用这些漏洞进行远程代码执行、信息泄露或提权等操作。由于公告未提供具体CVE
submit your research
Apple 安全发布页面（https://support.apple.com/en-us/102549）标题为“submit your research”，表明该页面是用于鼓励安全研究人员向 Apple 提交安全研究发现的入口。页面本身不包
Get help with security issues
Apple 发布了一个通用安全帮助页面，旨在指导用户如何报告安全问题或获取安全相关支持。该页面不包含任何特定的漏洞公告或技术细节，而是提供了联系 Apple 安全团队的方式。由于缺乏具体的漏洞描述、受影响产品及 CVE 编号，该公告对防守方