2026-07-22 归档

今日共收录 2277 条安全情报，包含 1464 个 CVE，419 篇安全通告，以及 96 篇研究论文。

漏洞预警2026-07-21 发布INFO

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any p...

CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full m

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-21 发布INFO

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary med...

CVE-2026-65054

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-21 发布INFO

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command inj...

CVE-2026-64881

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command exe

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-21 发布INFO

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attack...

CVE-2026-64822

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosi

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-07-21 发布INFO

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf o...

CVE-2026-64821

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-21 发布INFO

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' convers...

CVE-2026-63358

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to P

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-07-21 发布INFO

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value ...

CVE-2026-63140

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an unc...

CVE-2026-63139

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a speci...

CVE-2026-63136

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaint...

CVE-2026-63092

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-21 发布INFO

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants ...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-21 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse...

CVE-2026-56147

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-21 发布INFO

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file

CVE-2026-52476

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPage

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

CVE-2026-52474

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-21 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both ...

CVE-2026-47714

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code i

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-21 发布INFO

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly inter...

CVE-2026-47708

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name`

历史摘要 · 未重新核验 · NVD

#cve #cwe-77