2026-07-18 归档

今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAut...

CVE-2026-49216

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() ga...

CVE-2026-49215

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventList

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop...

CVE-2026-49212

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\Liv

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE express...

CVE-2026-49211

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\En

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the c...

CVE-2026-49210

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\Child

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the clie...

CVE-2026-49209

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-17 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfo...

CVE-2026-49208

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as Date

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-17 发布INFO

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py cause...

CVE-2026-44722

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python

历史摘要 · 未重新核验 · NVD

#cve #cwe-480

漏洞预警2026-07-17 发布INFO

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior u...

CVE-2026-21764

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restric

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-07-17 发布INFO

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME...

CVE-2026-21762

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections ag

历史摘要 · 未重新核验 · NVD

#cve #cwe-644

漏洞预警2026-07-17 发布INFO

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exp...

CVE-2026-21761

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-07-17 发布INFO

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to acces...

CVE-2026-21760

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper a

历史摘要 · 未重新核验 · NVD

#cve #cwe-425

漏洞预警2026-07-17 发布INFO

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to n...

CVE-2026-16108

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-17 发布INFO

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child rol...

CVE-2026-16106

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access mana...

CVE-2026-16104

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engi

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-07-17 发布INFO

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-...

CVE-2026-16103

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, wher

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-17 发布INFO

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discov...

CVE-2026-16093

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-07-17 发布INFO

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform...

CVE-2026-12691

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-07-17 发布INFO

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management S...

CVE-2026-11763

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-17 发布INFO

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed...

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode()

历史摘要 · 未重新核验 · NVD

#cve #cwe-208