2026-07-29 归档

今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-07-28 发布INFO

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on...

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-07-28 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue aff...

CVE-2026-8167

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-28 发布INFO

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in version...

CVE-2026-15267

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to,...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injec

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss o...

CVE-2026-14171

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-07-28 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-14170

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-28 发布INFO

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could re...

CVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted in

历史摘要 · 未重新核验 · NVD

#cve #cwe-696

漏洞预警2026-07-28 发布INFO

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system ac...

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.

CVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-28 发布INFO

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all version...

CVE-2026-13161

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection vi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon RES...

CVE-2026-12800

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code'

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of th...

CVE-2026-55977

Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the applicatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-07-28 发布INFO

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_si...

CVE-2026-15730

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-28 发布INFO

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment_plans'...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in al...

CVE-2026-15671

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' paramet...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and in...

CVE-2026-12741

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which dec...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polyno

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-28 发布INFO

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() f...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and i

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-28 发布INFO

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versi...

CVE-2026-16811

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-bas

历史摘要 · 未重新核验 · NVD

#cve #cwe-89