Chromium: CVE-2026-15770 Uninitialized Use in V8
CVE-2026-15770
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表Chromium: CVE-2026-15769 Insufficient validation of untrusted input in Linux Toolkit Theming
CVE-2026-15769
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-15768 Insufficient policy enforcement in HTML-in-Canvas
CVE-2026-15768
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-15766 Uninitialized Use in Skia
CVE-2026-15766
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-15765 Use after free in Ozone
CVE-2026-15765
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-15764 Use after free in Ozone
CVE-2026-15764
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities
该论文提出 Bulkhead，一个自动化框架，用于检测和修复容器逃逸中的路径遍历（PaTra）漏洞。背景是容器生态系统中的文件系统隔离常因跨边界路径解析错误而削弱，导致路径遍历漏洞。这些漏洞源于不安全的主机-容器交互，尤其是在云系统将共享资
Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled
CVE-2026-13410
Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is i
Kirby: `pages.access` permission is not checked during rendering of page drafts
CVE-2026-44176
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` per
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
CVE-2026-44981
CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
【EdgeOne】CNAME 域名生成规则调整公告
【EdgeOne】CNAME 域名生成规则调整公告
Pimcore: SQL Injection in Custom Reports Column Configuration
CVE-2026-44739
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigActi
Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood
CVE-2026-47184
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inser
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
CVE-2026-48016
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2026-49216
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/
TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint
CVE-2026-63098
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated atta
Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
CVE-2026-63095
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any
Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin
CVE-2026-62387
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default C