2026-07-23 归档

今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a speciall...

CVE-2026-63261

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can...

CVE-2026-63260

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data ...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplie

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-21 发布INFO

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrai...

CVE-2026-63145

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-21 发布INFO

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user w...

CVE-2026-63144

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request s

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-07-21 发布INFO

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access work...

CVE-2026-63143

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-21 发布INFO

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configu...

CVE-2026-63142

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reportin

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-21 发布INFO

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` d...

CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-07-21 发布INFO

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a r...

CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-401

漏洞预警2026-07-21 发布INFO

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-07-21 发布INFO

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is ...

CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function i

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-21 发布INFO

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument ...

CVE-2026-16486

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-07-21 发布INFO

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipul...

CVE-2026-16485

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-07-21 发布INFO

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corrup...

CVE-2026-16423

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage i

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-21 发布INFO

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domai...

CVE-2026-16422

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical ...

CVE-2026-8989

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through e

历史摘要 · 未重新核验 · NVD

#cve #cwe-1191 #cwe-1244

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An at...

CVE-2026-8988

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-1191

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacke...

CVE-2026-8987

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command ha

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server ca...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagno

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply ...

CVE-2026-8985

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed

历史摘要 · 未重新核验 · NVD

#cve #cwe-78