2026-07-18 归档

今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。

← 返回归档列表

漏洞预警2026-07-17 发布HIGH

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can ...

CVE-2026-54498

ViewComponent 是一个用于 Ruby on Rails 中构建可重用、可测试且封装良好的视图组件的框架。在版本 4.0.0 至 4.12.0 中，ViewComponent::Base#around_render 方法可能返回

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-17 发布MEDIUM

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that a...

CVE-2026-54466

WebSocket-driver 是一个支持可插拔 I/O 的 WebSocket 协议处理库。在版本 0.7.5 之前，该库在实现 WebSocket 协议草案版本（draft 版本）的帧格式时存在一个整数精度丢失漏洞。具体来说，draf

历史摘要 · 未重新核验 · NVD

#cve #cwe-130

漏洞预警2026-07-17 发布HIGH

css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch...

CVE-2026-53727

CVE-2026-53727 影响 Ruby CSS 解析器 css_parser，版本 2.2.0 至 3.0.0（不含3.0.0）。漏洞位于 lib/css_parser/parser.rb 中的 CssParser::Parser#r

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controlle...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-17 发布INFO

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-17 发布INFO

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-17 发布INFO

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that imp...

CVE-2026-50274

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monit

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-17 发布INFO

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/t...

CVE-2026-50272

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/bagga

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-17 发布INFO

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers withou...

CVE-2026-50271

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C bagga

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-17 发布INFO

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check w...

CVE-2026-49977

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-07-17 发布INFO

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. In 3.1.3 and earlier, the BST name-lookup loop in D...

CVE-2026-45785

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-07-17 发布INFO

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectl...

CVE-2026-45784

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::ciph

历史摘要 · 未重新核验 · NVD

#cve #cwe-131 #cwe-787

漏洞预警2026-07-17 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDeco...

CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-07-17 发布INFO

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of th...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plu

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying abso...

CVE-2026-13445

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read an

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-17 发布INFO

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be ...

CVE-2026-8861

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error messag

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-07-17 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filter...

CVE-2026-8056

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-17 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

CVE-2026-7872

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-17 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of se...

CVE-2026-7771

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted stat

历史摘要 · 未重新核验 · NVD

#cve #cwe-835