2026-07-21 归档

今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。

漏洞预警2026-07-20 发布INFO

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture grou...

CVE-2026-46516

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions...

CVE-2026-46410

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may le

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-20 发布INFO

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-...

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','j...

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enfo

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-07-20 发布INFO

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is cop...

CVE-2026-16277

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcin

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-07-20 发布INFO

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function of the file /admin...

CVE-2026-16252

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-20 发布INFO

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-20 发布INFO

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Be...

CVE-2026-57310

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-07-20 发布INFO

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Bl...

CVE-2026-57309

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to injec

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-20 发布INFO

A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. ...

CVE-2026-16248

A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-07-20 发布INFO

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionor...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-20 发布INFO

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbol...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-07-20 发布INFO

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as v...

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-20 发布INFO

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even whe...

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the s...

CVE-2026-64621

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_appl

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-07-20 发布INFO

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can ...

CVE-2026-63763

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileg

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-20 发布INFO

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scrip...

CVE-2026-63762

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because...

CVE-2026-63761

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES

历史摘要 · 未重新核验 · NVD

#cve #cwe-327

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticate...

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processin

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with dee...

CVE-2026-63759

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annot

历史摘要 · 未重新核验 · NVD

#cve #cwe-674