2026-08-08 归档

今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。

← 返回归档列表

安全公告2026-08-06 发布INFO

OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

CVE-2026-48054

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-94

安全公告2026-08-06 发布INFO

Frappe: Stored XSS in Column Headers via Data Import

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported co

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-08-06 发布INFO

OpenReception: WebAuthn passkey injection allows account takeover

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-08-06 发布INFO

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

CVE-2026-70636

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-06 发布INFO

Flowise 3.1.4 IDOR in OpenAI Assistants Integration

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-08-06 发布INFO

PHP_CodeSniffer gitblame report command injection via crafted filename

CVE-2026-67434

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-08-06 发布INFO

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final byt

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-125

安全公告2026-08-06 发布INFO

Frappe: Lack of Permissions in restore/bulk_restore

CVE-2026-47765

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-06 发布INFO

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-617

安全公告2026-08-06 发布INFO

Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

CVE-2026-47194

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346

安全公告2026-08-06 发布INFO

OpenReception doesn't rate limit passphrase login attempts

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions pri

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307

安全公告2026-08-06 发布INFO

OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

CVE-2026-48082

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-770

安全公告2026-08-06 发布INFO

jsoup: Cleaner may expose markup with custom raw-text elements

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectl

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-08-06 发布INFO

Frappe Has Broken Access Control in its Workspace Save API

CVE-2026-47185

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspac

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-863

安全公告2026-08-06 发布INFO

OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

CVE-2026-48079

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-613

安全公告2026-08-06 发布INFO

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

CVE-2026-61632

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.2

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-08-06 发布INFO

OpenReception: GET appointment by ID returns full appointment record without authorization

CVE-2026-48077

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-06 发布INFO

OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-clie

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-08-06 发布INFO

OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

CVE-2026-48075

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-06 发布INFO

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially craf

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1050 #cwe-407