2026-07-18 归档

今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。

← 返回归档列表

漏洞预警2026-07-17 发布INFO

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to,...

CVE-2026-15395

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-17 发布INFO

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parame...

CVE-2026-15160

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and incl

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-17 发布INFO

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_for...

CVE-2026-15159

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-17 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticat...

CVE-2026-62387

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default C

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-07-17 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractB...

CVE-2026-62386

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-07-17 发布INFO

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset...

CVE-2026-62238

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-17 发布INFO

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandb...

CVE-2026-62237

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-07-17 发布INFO

grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new T...

CVE-2026-62236

grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASec

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-17 发布INFO

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission ...

CVE-2026-62235

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-636 #cwe-862

漏洞预警2026-07-17 发布INFO

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://,...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.w

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-07-17 发布INFO

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization,...

CVE-2026-62232

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FAS

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator ...

CVE-2026-62231

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack th...

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access t

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended author...

CVE-2026-62229

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lowe

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers ...

CVE-2026-62227

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with...

CVE-2026-62226

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond t...

CVE-2026-62225

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows l

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access ca...

CVE-2026-62224

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mu

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their inten...

CVE-2026-62223

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-863