2026-07-23 归档

今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-22 发布INFO

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user ...

CVE-2026-65594

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-22 发布INFO

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers...

CVE-2026-65593

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-22 发布INFO

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedRes...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-22 发布INFO

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can ...

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-917

漏洞预警2026-07-22 发布INFO

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macO...

CVE-2026-65590

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-22 发布INFO

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution re...

CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-22 发布INFO

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewe...

CVE-2026-65015

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-22 发布INFO

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing ...

CVE-2026-65014

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-07-22 发布INFO

There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.

CVE-2026-61392

There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-22 发布INFO

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted ...

CVE-2026-61391

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-07-22 发布INFO

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

CVE-2026-61390

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-22 发布INFO

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

CVE-2026-57600

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-22 发布INFO

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain...

CVE-2026-57599

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the d

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-22 发布INFO

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 b...

CVE-2026-4773

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authenticati

历史摘要 · 未重新核验 · NVD

#cve #cwe-1287

漏洞预警2026-07-22 发布INFO

A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through...

CVE-2026-44192

A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traver

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-22 发布INFO

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands ...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) a

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-22 发布INFO

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a maliciou...

CVE-2026-44189

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injec

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-07-22 发布INFO

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with ...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with

历史摘要 · 未重新核验 · NVD

#cve #cwe-256

漏洞预警2026-07-22 发布INFO

Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only.

CVE-2026-16551

Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affe

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-835

漏洞预警2026-07-22 发布INFO

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, wor...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are

历史摘要 · 未重新核验 · NVD

#cve #cwe-862