2026-07-15 归档

今日共收录 995 条安全情报，包含 81 个 CVE，528 篇安全通告，以及 87 篇研究论文。

漏洞预警2026-07-13 发布HIGH

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails t...

CVE-2026-58101

此漏洞影响 Perl 的 Crypt::OpenSSL::X509 模块 2.1.3 之前的版本。当解析来自不受信任证书的扩展时，由于多个函数（如 basicC、ia5string、auth_att）在调用 X509V3_EXT_d2i(e

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-07-13 发布HIGH

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the...

CVE-2026-57856

Cockpit CMS 是一个内容管理系统，其Bucket文件存储API（/system/buckets/api）存在路径遍历漏洞。漏洞位于 modules/System/Controller/Buckets.php 的 api() 方法中

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-13 发布HIGH

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and rea...

CVE-2026-62200

OpenClaw 2026.6.6 之前版本中存在一个主机执行环境过滤缺陷，允许攻击者滥用 Git 扩展传输。当受影响的特性被启用且可访问时，低信任度的调用者或配置的输入路径可能会执行或持久化超出其授权范围的操作。该漏洞无需用户交互即可通过

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-07-13 发布HIGH

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachab...

CVE-2026-62199

CVE-2026-62199 是 OpenClaw 软件中的一个高危漏洞，影响 2026.6.6 之前的所有版本。该漏洞存在于主机执行环境过滤机制中，未能正确过滤解释器启动变量，导致低信任度的调用者或配置的输入路径可以通过提供精心构造的环境

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-07-13 发布HIGH

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network...

CVE-2026-62197

OpenClaw 是一个网络策略管理工具，其浏览器 CDP（Chrome DevTools Protocol）发现功能存在策略绕过漏洞。受影响的版本（2026.6.6 之前）在处理 WebSocket URL 时未能正确验证，导致攻击者可以

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-13 发布HIGH

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools...

CVE-2026-62195

OpenClaw 是一款流行的云计算平台管理工具。在2026.5.20至2026.6.6之前的版本中，MCP环路功能存在授权绕过漏洞。攻击者可以通过精心构造的输入路径绕过授权检查，以较低信任级别执行原本仅允许所有者操作的命令或持久化操作。该

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-07-13 发布MEDIUM

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected fea...

CVE-2026-62193

CVE-2026-62193 是 OpenClaw 2026.6.5 至 2026.6.8 版本中存在的一个授权绕过漏洞。漏洞位于插件安装封装器（plugin install wrappers）中，当受影响功能被启用且可访问时，攻击者可能绕

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布HIGH

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring st...

CVE-2026-62192

CVE-2026-62192 是 OpenClaw（一个 Discord 管理机器人）中的授权绕过漏洞，影响版本 2026.6.6 至 2026.6.9（不含 2026.6.9）。漏洞存在于 Discord 公会操作中，由于输入路径配置错误

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their i...

CVE-2026-62190

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-706 #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger auth...

CVE-2026-62189

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-07-13 发布INFO

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablemen...

CVE-2026-62188

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Fe

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform ...

CVE-2026-62187

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A low

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requ...

CVE-2026-62186

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-07-13 发布INFO

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit thi...

CVE-2026-62185

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access r

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-07-13 发布INFO

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to...

CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-07-13 发布INFO

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. A...

CVE-2026-61458

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-07-13 发布INFO

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI ...

CVE-2026-58500

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-13 发布INFO

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of u...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-13 发布INFO

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM sessio...

CVE-2026-56877

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplie

历史摘要 · 未重新核验 · NVD

#cve #cwe-472

漏洞预警2026-07-13 发布INFO

A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network r...

CVE-2026-51539

A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issu

历史摘要 · 未重新核验 · NVD

#cve #cwe-400