京ICP证080047号[京ICP备08010314号-6]
该条输入内容为ICP备案信息页面（京ICP证080047号，京ICP备08010314号-6），来源于360CERT抓取的工信部备案网站（beian.miit.gov.cn），并非真正的安全漏洞公告。公告标题和正文均未包含任何漏洞描述、受影
2026-08-07 归档
今日共收录 1483 条安全情报，包含 647 个 CVE，430 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation. The ro...
CVE-2026-70558
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path)
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials b...
CVE-2026-67622
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration th
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler...
CVE-2026-53984
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerabilit
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff...
CVE-2026-48088
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at `POST /api/auth/r...
CVE-2026-48087
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platfor...
CVE-2026-48086
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance ac...
CVE-2026-48085
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-...
CVE-2026-3418
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or desti
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium ...
CVE-2026-19170
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially per
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium sec...
CVE-2026-19149
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perfor
A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS old...
CVE-2026-18367
A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage p...
CVE-2026-17032
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allo
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code exe...
CVE-2026-14812
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsig...
CVE-2026-11976
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke the...
CVE-2025-14561
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in o
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthen...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injecti
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
CVE-2026-66709
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
CVE-2026-66662
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.