2026-07-30 归档

今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。

← 返回归档列表

漏洞预警2026-07-29 发布INFO

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Co...

CVE-2026-16328

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-29 发布INFO

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vul...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-07-29 发布INFO

In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_target_code2...

CVE-2026-10684

In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredu

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-07-29 发布INFO

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacen...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-07-29 发布INFO

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does no...

CVE-2026-59920

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Fina

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-07-29 发布INFO

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writ...

CVE-2026-59919

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Fina

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-07-29 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec p...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final,

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-07-29 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2Strea...

CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final,

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-07-29 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production ha...

CVE-2026-59899

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final,

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-29 发布INFO

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/...

CVE-2026-54705

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode conten

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-07-29 发布INFO

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary c...

CVE-2026-40272

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted k

历史摘要 · 未重新核验 · NVD

#cve #cwe-1284

漏洞预警2026-07-29 发布INFO

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session...

CVE-2026-18236

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-29 发布INFO

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installat...

CVE-2026-14266

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-29 发布INFO

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalizati...

CVE-2026-13723

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrar

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-07-29 发布INFO

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a...

CVE-2026-8339

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclus

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-29 发布INFO

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can s...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-07-29 发布INFO

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEAR...

CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-07-29 发布INFO

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-29 发布INFO

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure prov...

CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-29 发布INFO

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buff...

CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler imple

历史摘要 · 未重新核验 · NVD

#cve