Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
CVE-2026-55495
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-W
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表OpenClaw Dashboard Stored XSS via lastMessage Session Field
CVE-2026-66421
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to
NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
CVE-2026-18064
An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a s
GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS
CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
CVE-2026-55768
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
GoAccess: Heap Out-of-Bounds Write in parse_browser()
CVE-2026-54715
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
WACRM: SSRF via the automation `send_webhook` action
CVE-2026-67530
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/
OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
CVE-2026-67529
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /ap
Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
CVE-2026-66415
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated a
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
CVE-2026-54768
## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
CVE-2026-54908
### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches
hashi-vault-js has a path traversal and query parameter injection
CVE-2026-55100
## Summary The `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of p
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
CVE-2026-68499
## Summary `String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cur
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
CVE-2026-68500
### Impact The shop payment webhook `POST /{_locale}/update-payment` (route `sylius_mollie_shop_payment_webhook`) ac
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Research Report: Testing and Evaluating Artificial Intelligence Applications.
本研究报告提出并演示了 TEAIS（Test and Evaluation of AI systems，AI 系统测试与评估）框架，这是一种用于评估大型语言模型（LLM）性能的原则性方法。作者通过一个教学示例详细阐述了 TEAIS 的运作流
Firewall for AI
该输入为 Akamai 官方发布的 'Firewall for AI' 产品页面，并非针对具体攻击事件或漏洞的情报报告。页面内容表明，Akamai 推出了一款专门保护人工智能（AI）应用的防火墙产品，旨在应对针对 AI 服务的分布式拒绝服务
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, includi
The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-13362
The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_