2026-07-28 归档

今日共收录 1224 条安全情报，包含 453 个 CVE，382 篇安全通告，以及 98 篇研究论文。

漏洞预警2026-07-27 发布INFO

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects o...

CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-470

漏洞预警2026-07-27 发布INFO

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website...

CVE-2026-66825

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with li

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-27 发布INFO

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(ar...

CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-27 发布INFO

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). Authentication-related cr...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Arc

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications usi...

CVE-2026-64646

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Serv...

CVE-2026-64643

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built...

CVE-2026-64642

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applicat...

CVE-2026-64641

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-834

漏洞预警2026-07-27 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IP...

CVE-2026-54272

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-07-27 发布INFO

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client i...

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in

历史摘要 · 未重新核验 · NVD

#cve #cwe-757

漏洞预警2026-07-27 发布INFO

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowle...

CVE-2025-59180

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm s

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-07-27 发布INFO

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce ...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved ext

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-26 发布INFO

Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-57990

Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-552

漏洞预警2026-07-26 发布INFO

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-57989

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-07-26 发布INFO

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-57978

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

安全公告2026-07-28 发布INFO

Compatibility Test Suite (CTS)

Android 兼容性测试套件（CTS）是 Google 提供的用于验证 Android 设备与 Android 应用程序兼容性的工具集。CTS 包含一系列测试用例，覆盖核心框架、系统 API、硬件特性等方面，确保设备符合 Android