Cyber Security Daily Radar

2026-07-30 归档

今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。

← 返回归档列表
漏洞预警2026-07-29 发布INFO

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONU...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON

历史摘要 · 未重新核验 · NVD

#cve#cwe-674
漏洞预警2026-07-29 发布INFO

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given ...

CVE-2026-67214

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure mo

历史摘要 · 未重新核验 · NVD

#cve#cwe-835
漏洞预警2026-07-29 发布INFO

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal gene...

CVE-2026-67213

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these fun

历史摘要 · 未重新核验 · NVD

#cve#cwe-835
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

CVE-2026-66490

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

历史摘要 · 未重新核验 · NVD

#cve#cwe-79
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

CVE-2026-66489

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

历史摘要 · 未重新核验 · NVD

#cve
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

CVE-2026-66488

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

历史摘要 · 未重新核验 · NVD

#cve
漏洞预警2026-07-29 发布INFO

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate R...

CVE-2026-66400

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php wh

历史摘要 · 未重新核验 · NVD

#cve#cwe-613
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

CVE-2026-65890

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthe

历史摘要 · 未重新核验 · NVD

#cve#cwe-89
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

CVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allow

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-284
漏洞预警2026-07-29 发布INFO

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534...

CVE-2026-55995

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects

历史摘要 · 未重新核验 · NVD

#cve#cwe-415
漏洞预警2026-07-29 发布INFO

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser ...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header

历史摘要 · 未重新核验 · NVD

#cve#cwe-20#cwe-184
漏洞预警2026-07-29 发布INFO

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency con...

CVE-2026-16751

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an auth

历史摘要 · 未重新核验 · NVD

#cve
漏洞预警2026-07-29 发布INFO

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

历史摘要 · 未重新核验 · NVD

#cve#cwe-79
漏洞预警2026-07-29 发布INFO

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

CVE-2026-65944

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

历史摘要 · 未重新核验 · NVD

#cve#cwe-352
漏洞预警2026-07-29 发布INFO

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

CVE-2026-65943

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

历史摘要 · 未重新核验 · NVD

#cve#cwe-284
漏洞预警2026-07-29 发布INFO

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input ...

CVE-2026-65891

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function

历史摘要 · 未重新核验 · NVD

#cve#cwe-20
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns in...

CVE-2026-65885

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows au

历史摘要 · 未重新核验 · NVD

#cve#cwe-434
漏洞预警2026-07-29 发布INFO

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to regis...

CVE-2026-65884

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provide

历史摘要 · 未重新核验 · NVD

#cve#cwe-284
漏洞预警2026-07-29 发布INFO

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change the...

CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in

历史摘要 · 未重新核验 · NVD

#cve#cwe-256
漏洞预警2026-07-29 发布INFO

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through ...

CVE-2026-44944

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control soc

历史摘要 · 未重新核验 · NVD

#cve#cwe-863