NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techni
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subt
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable...
CVE-2026-17161
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
CVE-2026-54658
### Impact A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attack
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
CVE-2026-64863
## Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebD
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
CVE-2026-62325
## Summary Start goshs v2.1.3 with `-b 'admin:' -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
CVE-2026-54654
### Summary `datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-dat
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
CVE-2026-55391
### Summary `datamodel-code-generator`'s anti-SSRF guard validates the resolved IP of a fetch target once and then lets
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
CVE-2026-54690
### Summary JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-gener
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
CVE-2026-55403
### Summary When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the origi
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive...
CVE-2026-16581
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulner
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written...
CVE-2026-14973
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's s
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication...
CVE-2026-14512
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization whi
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to...
CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of creden
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege...
CVE-2026-14446
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the adminis
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute...
CVE-2026-14958
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute...
CVE-2026-14959
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to
Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session...
CVE-2026-66745
Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability t
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse...
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-H
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
CVE-2026-54691
### Summary `datamodel-code-generator`'s built-in HTTP fetcher (`http.get_body`) issues an `httpx.GET` against any URL