【EdgeOne】CNAME 域名生成规则调整公告
【EdgeOne】CNAME 域名生成规则调整公告
2026-07-21 归档
今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。
← 返回归档列表Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
CVE-2026-63769
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir
HyperDX < 2.31.0 SSRF via Webhook Test Endpoint
CVE-2026-63730
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir
LimeSurvey SSRF via REST API Survey Template Host Header
CVE-2026-63107
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey templat
RT: Reflected Cross-Site Scripting via URL parameters
CVE-2026-44227
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contai
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
CVE-2026-46715
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentica
Chamilo stored XSS via user registration leads to admin account takeover
CVE-2026-39878
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration fo
WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
CVE-2026-46555
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
CVE-2026-58482
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalI
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
CVE-2026-46701
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an e
i2c: i801: fix hardware state machine corruption in error path
CVE-2026-64205
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in
The application evaluate UNC path in workspace name
CVE-2026-25039
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanit
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
CVE-2026-54910
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`
FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
CVE-2026-54685
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` a
FileBrowser Quantum: unauthenticated user share share info
CVE-2026-46410
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may le
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
CVE-2026-45138
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` v
Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
CVE-2026-44359
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands...
CVE-2026-63767
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability t
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
CVE-2026-59731
# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary As