2026-07-23 归档

今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-21 发布INFO

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to ...

CVE-2026-44880

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vuln

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-07-21 发布INFO

This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Da...

CVE-2026-21579

This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-21 发布INFO

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center...

CVE-2026-21577

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-21 发布INFO

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Executi...

CVE-2026-21575

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-21 发布INFO

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of...

CVE-2026-16493

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manage

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-07-21 发布INFO

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.

CVE-2026-16439

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.

历史摘要 · 未重新核验 · NVD

#cve #cwe-124

漏洞预警2026-07-21 发布INFO

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

CVE-2026-16243

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes t

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-07-21 发布INFO

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{wor...

CVE-2026-47407

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platfor

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-639 #cwe-863

漏洞预警2026-07-21 发布INFO

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level aut...

CVE-2026-47399

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspa

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-639

漏洞预警2026-07-21 发布INFO

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. T...

CVE-2026-16454

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identifie

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-862

漏洞预警2026-07-21 发布INFO

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload ...

CVE-2026-16451

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-07-21 发布INFO

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. Th...

CVE-2026-15829

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecastin

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-863

漏洞预警2026-07-21 发布INFO

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitr...

CVE-2026-15724

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-73

漏洞预警2026-07-21 发布INFO

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig ...

CVE-2026-15432

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time compar

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-21 发布INFO

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging ...

CVE-2026-15342

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one wo

历史摘要 · 未重新核验 · NVD

#cve #cwe-552 #cwe-639

漏洞预警2026-07-21 发布INFO

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices fro...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint T

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-07-21 发布INFO

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a ...

CVE-2026-64823

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-21 发布INFO

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.

CVE-2026-56586

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man

历史摘要 · 未重新核验 · NVD

#cve #cwe-16

漏洞预警2026-07-21 发布INFO

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user ac...

CVE-2026-56585

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the appli

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-07-21 发布INFO

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed ...

CVE-2026-47390

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso

历史摘要 · 未重新核验 · NVD

#cve #cwe-918