2026-07-22 归档

今日共收录 2277 条安全情报，包含 1464 个 CVE，419 篇安全通告，以及 96 篇研究论文。

漏洞预警2026-07-20 发布INFO

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file

CVE-2026-51025

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related t...

CVE-2026-47255

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-89 #cwe-284 #cwe-319 #cwe-798

漏洞预警2026-07-20 发布INFO

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Ap...

CVE-2026-47134

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private k

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-07-20 发布INFO

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Li...

CVE-2026-47133

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-07-20 发布INFO

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sock...

CVE-2026-47128

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landloc

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should ...

CVE-2026-44510

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-20 发布INFO

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulatio...

CVE-2026-16324

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-07-20 发布INFO

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block in all versions ...

CVE-2026-12900

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-S

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName

CVE-2024-51316

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /g

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-20 发布INFO

The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process wh...

CVE-2026-64651

The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provide...

CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-20 发布INFO

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certifica...

CVE-2026-56624

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side an

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-07-20 发布INFO

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apach...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-20 发布INFO

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files o...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-07-20 发布INFO

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeSco

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-07-20 发布INFO

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-vie...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-20 发布INFO

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the...

CVE-2026-47130

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Le

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-20 发布INFO

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deac...

CVE-2026-47129

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Co

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service...

CVE-2026-44585

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-07-20 发布INFO

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook proce...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-918