2026-08-04 归档

今日共收录 1122 条安全情报，包含 327 个 CVE，410 篇安全通告，以及 104 篇研究论文。

← 返回归档列表

漏洞预警2026-08-03 发布INFO

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDoma...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of

历史摘要 · 未重新核验 · NVD

#cve #cwe-180 #cwe-346 #cwe-384

漏洞预警2026-08-03 发布INFO

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building a...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap r

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-400 #cwe-416

漏洞预警2026-08-03 发布INFO

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inp...

CVE-2026-67976

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.

CVE-2026-67972

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an inco...

CVE-2026-66065

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-94

漏洞预警2026-08-03 发布INFO

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via th

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject ...

CVE-2026-52520

Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metac...

CVE-2026-52102

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to exe

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component

CVE-2026-51775

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the applicati

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spaw

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in t...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to injec

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-03 发布INFO

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traff...

CVE-2026-48113

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated client

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-03 发布INFO

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the place...

CVE-2026-48063

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baile

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-345 #cwe-346

漏洞预警2026-08-03 发布INFO

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the un...

CVE-2026-41447

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbit

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-08-03 发布INFO

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit ...

CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote att

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-08-03 发布INFO

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in...

CVE-2026-18737

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a cra...

CVE-2026-18736

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-03 发布INFO

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the ag...

CVE-2026-18733

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-03 发布INFO

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component rea...

CVE-2026-18648

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-03 发布INFO

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/func...

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue

历史摘要 · 未重新核验 · NVD

#cve #cwe-918