2026-08-03 归档

今日共收录 797 条安全情报，包含 119 个 CVE，373 篇安全通告，以及 59 篇研究论文。

漏洞预警2026-08-02 发布INFO

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Privat...

CVE-2026-10774

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/blue

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-08-02 发布INFO

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. W...

CVE-2026-68583

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field th

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-02 发布INFO

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{v...

CVE-2026-68582

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-col

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-02 发布INFO

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-02 发布INFO

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to val...

CVE-2026-68580

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-02 发布INFO

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine p

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-02 发布INFO

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attacke...

CVE-2026-67357

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-02 发布INFO

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() withou...

CVE-2026-67356

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-02 发布INFO

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete ar...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey delet

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-02 发布INFO

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including...

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_info

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-02 发布INFO

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator c...

CVE-2026-18573

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authoriza

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-02 发布INFO

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hour...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policie

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-02 发布INFO

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-02 发布INFO

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during c...

CVE-2026-18570

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This componen

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-02 发布INFO

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticat...

CVE-2026-16540

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operati

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-02 发布INFO

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the m...

CVE-2026-16292

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-meta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-02 发布INFO

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a...

CVE-2026-16291

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user befo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-02 发布INFO

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated user...

CVE-2026-16285

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before str

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-02 发布INFO

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contribu...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-02 发布INFO

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions ...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the req

历史摘要 · 未重新核验 · NVD

#cve