2026-07-29 归档

今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-07-28 发布INFO

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced duri...

CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite agg

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-28 发布INFO

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously register...

CVE-2026-54619

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite func

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-07-28 发布INFO

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to th...

CVE-2026-54609

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handle

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-406 #cwe-770

漏洞预警2026-07-28 发布INFO

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of...

CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-346 #cwe-918

漏洞预警2026-07-28 发布INFO

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returne...

CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-601

漏洞预警2026-07-28 发布INFO

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size fr...

CVE-2026-54345

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes

历史摘要 · 未重新核验 · NVD

#cve #cwe-191 #cwe-770

漏洞预警2026-07-28 发布INFO

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote attackers to execute arbitrary code or caus...

CVE-2026-51275

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-28 发布INFO

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service ...

CVE-2026-51274

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audio

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-28 发布INFO

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The...

CVE-2026-51273

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-28 发布INFO

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.

CVE-2026-18085

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows A

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-07-28 发布INFO

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSS). This issue a...

CVE-2026-18084

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackB

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-28 发布INFO

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name s...

CVE-2026-16313

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-07-28 发布INFO

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit ...

CVE-2026-8058

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resou

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-28 发布INFO

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.

CVE-2026-7868

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges an

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-28 发布INFO

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header ...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchroni

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-07-28 发布INFO

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server ...

CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-07-28 发布INFO

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header value...

CVE-2026-66753

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-07-28 发布INFO

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header wit...

CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-07-28 发布INFO

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request ...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protecte...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

历史摘要 · 未重新核验 · NVD

#cve #cwe-862