2026-07-23 归档

今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-21 发布INFO

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker ...

CVE-2026-8983

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorizati

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-07-21 发布INFO

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms on...

CVE-2026-65058

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip155

历史摘要 · 未重新核验 · NVD

#cve #cwe-358

漏洞预警2026-07-21 发布INFO

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud ...

CVE-2026-65056

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal netw

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-21 发布INFO

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary med...

CVE-2026-65054

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-21 发布INFO

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command inj...

CVE-2026-64881

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command exe

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-21 发布INFO

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attack...

CVE-2026-64822

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosi

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-07-21 发布INFO

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf o...

CVE-2026-64821

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-21 发布INFO

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' convers...

CVE-2026-63358

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to P

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-07-21 发布INFO

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value ...

CVE-2026-63140

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an unc...

CVE-2026-63139

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a speci...

CVE-2026-63136

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants ...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-21 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse...

CVE-2026-56147

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-21 发布INFO

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file

CVE-2026-52476

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPage

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-21 发布INFO

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-21 发布INFO

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

CVE-2026-52474

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-21 发布INFO

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both ...

CVE-2026-47714

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code i

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-21 发布INFO

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly inter...

CVE-2026-47708

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name`

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-07-21 发布INFO

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entit...

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace).

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-21 发布INFO

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vuln...

CVE-2026-47690

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-1336