2026-08-01 归档

今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。

漏洞预警2026-07-31 发布INFO

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTa

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-07-31 发布INFO

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template UR...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-direc

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-180

漏洞预警2026-07-31 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP lis...

CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started w

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-195

漏洞预警2026-07-31 发布INFO

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javas...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElem

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-07-31 发布INFO

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments ...

CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-31 发布INFO

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticat...

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/s

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-07-31 发布INFO

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE a...

CVE-2026-53551

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-31 发布INFO

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, ...

CVE-2026-53510

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-31 发布INFO

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a co...

CVE-2026-38711

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-31 发布INFO

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG...

CVE-2026-18394

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to ob

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderContro...

CVE-2026-57232

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end mod

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-31 发布INFO

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to pre...

CVE-2026-55824

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs ...

CVE-2026-53505

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion() filter do

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated n...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-con...

CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(, , ) filt

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-369

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing tr...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the...

CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypasse

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-31 发布INFO

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a ...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-31 发布INFO

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For h...

CVE-2026-25552

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-07-31 发布INFO

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to fu...

CVE-2026-18481

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79