2026-07-16 归档

今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-14 发布INFO

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validati...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tor

历史摘要 · 未重新核验 · NVD

#cve #cwe-126

漏洞预警2026-07-14 发布INFO

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header,...

CVE-2026-49853

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-cop

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-14 发布INFO

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to ...

CVE-2026-49477

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-07-14 发布INFO

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling la...

CVE-2026-49476

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-07-14 发布INFO

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attri...

CVE-2026-49459

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(roo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-693 #cwe-1321

漏洞预警2026-07-14 发布INFO

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm...

CVE-2026-49458

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(nod

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-501 #cwe-693

漏洞预警2026-07-14 发布INFO

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integr...

CVE-2026-48816

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify deriv

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-07-14 发布INFO

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the p...

CVE-2026-48815

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-14 发布INFO

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexit...

CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the pack

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-07-14 发布INFO

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when...

CVE-2026-48758

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-14 发布INFO

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue re...

CVE-2026-48370

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue req...

CVE-2026-48369

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue re...

CVE-2026-48367

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue re...

CVE-2026-48366

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the curre...

CVE-2026-48344

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could resul

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-07-14 发布INFO

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires ...

CVE-2026-48343

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issu...

CVE-2026-48342

Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-14 发布INFO

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires ...

CVE-2026-48341

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-14 发布INFO

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...

CVE-2026-48340

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-822

漏洞预警2026-07-14 发布INFO

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue req...

CVE-2026-48339

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co

历史摘要 · 未重新核验 · NVD

#cve #cwe-122