2026-07-23 归档

今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced pe...

CVE-2026-13190

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities all

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-si...

CVE-2026-13189

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell c

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chai...

CVE-2026-13188

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potential

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained explo...

CVE-2026-13187

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentia

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is de...

CVE-2026-13186

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie ...

CVE-2026-13185

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity...

CVE-2026-13184

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKe

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling...

CVE-2026-13183

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an ora...

CVE-2026-13182

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt f

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolutio...

CVE-2026-13181

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName process

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-07-22 发布INFO

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identif...

CVE-2026-8152

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-601

漏洞预警2026-07-22 发布INFO

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvi...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) a

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-22 发布INFO

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it ca...

CVE-2026-16270

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-07-22 发布INFO

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the upda...

CVE-2026-65603

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-22 发布INFO

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist...

CVE-2026-65602

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-22 发布INFO

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplaceP...

CVE-2026-65600

Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-22 发布INFO

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mis...

CVE-2026-65599

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo

历史摘要 · 未重新核验 · NVD

#cve #cwe-312

漏洞预警2026-07-22 发布INFO

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swappin...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-07-22 发布INFO

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an ifr...

CVE-2026-65597

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-22 发布INFO

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in...

CVE-2026-65596

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-863