2026-07-29 归档

今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-07-27 发布INFO

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. Connecting to a malici...

CVE-2026-28931

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Ta

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-07-27 发布INFO

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to elevate privileges.

CVE-2026-28926

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-07-27 发布INFO

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to elevate privileges.

CVE-2026-28912

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-07-27 发布INFO

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gat...

CVE-2026-28900

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-693

漏洞预警2026-07-27 发布INFO

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able to cause unexpected system termi...

CVE-2026-28896

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8.

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-07-27 发布INFO

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

CVE-2026-28849

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A malici

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-693

漏洞预警2026-07-27 发布INFO

An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to access sens...

CVE-2026-20672

An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects ...

CVE-2026-64649

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body ma...

CVE-2026-64648

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-524

漏洞预警2026-07-27 发布INFO

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CV...

CVE-2026-59729

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-27 发布INFO

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is app...

CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83 #cwe-116

漏洞预警2026-07-27 发布INFO

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and hei...

CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory alloca

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-07-27 发布INFO

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScri...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may...

CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-07-27 发布INFO

schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used to access static and heap ta...

CVE-2026-51244

schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controll

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-07-27 发布INFO

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScr...

CVE-2026-66030

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-27 发布INFO

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScri...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-27 发布INFO

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accoun...

CVE-2026-66028

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-303

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that buil...

CVE-2026-64645

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-601 #cwe-918

漏洞预警2026-07-27 发布INFO

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default ...

CVE-2026-64644

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-407