2026-08-04 归档

今日共收录 1122 条安全情报，包含 327 个 CVE，410 篇安全通告，以及 104 篇研究论文。

漏洞预警2026-08-03 发布INFO

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executin...

CVE-2026-18646

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-03 发布INFO

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoi...

CVE-2026-18645

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /sys

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-03 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSub...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, ev

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-08-03 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it...

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-08-03 发布INFO

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait...

CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-754

漏洞预警2026-08-03 发布INFO

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum re...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-08-03 发布INFO

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion ...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-03 发布INFO

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Upd...

CVE-2026-68979

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-03 发布INFO

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitize...

CVE-2026-67599

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-03 发布INFO

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTP...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-03 发布INFO

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.E...

CVE-2026-66296

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-sit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-03 发布INFO

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The pr...

CVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-03 发布INFO

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credent...

CVE-2026-58139

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with S

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-03 发布INFO

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a use...

CVE-2026-47211

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-08-03 发布INFO

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote un...

CVE-2026-18655

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.

历史摘要 · 未重新核验 · NVD

#cve #cwe-923

漏洞预警2026-08-03 发布INFO

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoin...

CVE-2026-18644

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-03 发布INFO

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignD...

CVE-2026-18641

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-08-03 发布INFO

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_tran...

CVE-2026-18632

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of

历史摘要 · 未重新核验 · NVD

#cve #cwe-791 #cwe-1336

漏洞预警2026-08-03 发布INFO

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeep...

CVE-2026-18631

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-03 发布INFO

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker wit...

CVE-2026-59913

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Criti

历史摘要 · 未重新核验 · NVD

#cve #cwe-306