2026-07-17 归档

今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-07-16 发布INFO

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_ge...

CVE-2026-46515

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-16 发布INFO

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_exten...

CVE-2026-46514

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-16 发布INFO

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes...

CVE-2026-46513

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by T

历史摘要 · 未重新核验 · NVD

#cve #cwe-256

漏洞预警2026-07-16 发布INFO

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The ...

CVE-2026-46404

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly res

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-16 发布INFO

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*To...

CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-07-16 发布INFO

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCur...

CVE-2026-46377

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-07-16 发布INFO

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to ...

CVE-2026-46353

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-16 发布INFO

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/...

CVE-2026-46351

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-330

漏洞预警2026-07-16 发布INFO

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in Snippe...

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-16 发布INFO

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php witho...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-24 #cwe-98

漏洞预警2026-07-16 发布INFO

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes...

CVE-2026-46686

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-16 发布INFO

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the...

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-183

漏洞预警2026-07-16 发布INFO

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated use...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-07-16 发布INFO

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized...

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_call

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-07-16 发布INFO

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO...

CVE-2026-44969

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-16 发布INFO

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and ...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-07-16 发布INFO

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrat...

CVE-2026-15945

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-16 发布INFO

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended loggi...

CVE-2026-15737

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-16 发布INFO

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that whe...

CVE-2026-9046

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications

历史摘要 · 未重新核验 · NVD

#cve #cwe-277

漏洞预警2026-07-16 发布INFO

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticat...

CVE-2026-6511

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart

历史摘要 · 未重新核验 · NVD

#cve #cwe-306