2026-07-17 归档

今日共收录 1302 条安全情报,包含 372 个 CVE,507 篇安全通告,以及 120 篇研究论文。

← 返回归档列表
安全公告2026-07-15 发布INFO

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscrib

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

CVE-2026-33684

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

CVE-2026-55608

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

CVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

NocoBase backup restore schema name allows command injection

CVE-2026-55410

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

CVE-2026-52887

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

CVE-2026-52888

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

CVE-2026-59950

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1,

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

CVE-2026-52870

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 unti

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

CVE-2026-52869

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2,

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

CVE-2026-45737

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Ar

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD us

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

DataEase: Stored SQL Injection Vulnerability

CVE-2026-45535

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store atta

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

DataEase: SQL injection vulnerability

CVE-2026-45417

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

DataEase: RCE Vulnerability

CVE-2026-45534

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connecti

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 funct

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

CVE-2026-62378

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS C

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected...

CVE-2026-62220

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limit

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attacker...

CVE-2026-62210

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-rea

历史摘要 · 未重新核验 · NVD