2026-07-21 归档

今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。

漏洞预警2026-07-20 发布INFO

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 clie...

CVE-2026-47275

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicio

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-07-20 发布INFO

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''`...

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an e

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-07-20 发布INFO

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP...

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-306 #cwe-346

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not ...

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-125

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding ...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within t

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing time...

CVE-2026-42218

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login in

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode....

CVE-2026-41521

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing s

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-20 发布INFO

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to t...

CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE)

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-95

漏洞预警2026-07-20 发布INFO

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), sy...

CVE-2026-39879

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-07-20 发布INFO

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has bee...

CVE-2026-39385

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-07-20 发布INFO

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number...

CVE-2026-35591

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before an

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-20 发布INFO

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag gr...

CVE-2026-35590

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and in

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-20 发布INFO

NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may s...

CVE-2026-35217

NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-07-20 发布INFO

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine ...

CVE-2026-33328

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-20 发布INFO

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions l...

CVE-2026-33327

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and includ

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-20 发布INFO