2026-08-08 归档

今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-08-06 发布INFO

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulne...

CVE-2026-7406

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference

历史摘要 · 未重新核验 · NVD

#cve #cwe-822

漏洞预警2026-08-06 发布INFO

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious act...

CVE-2026-7405

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-B

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-06 发布INFO

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header,...

CVE-2026-71555

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS do

历史摘要 · 未重新核验 · NVD

#cve #cwe-1022

漏洞预警2026-08-06 发布INFO

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequenc...

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final byt

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-06 发布INFO

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control charact...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectl

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially craf

历史摘要 · 未重新核验 · NVD

#cve #cwe-407 #cwe-1050

漏洞预警2026-08-06 发布INFO

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypass...

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the Attributes

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-86 #cwe-692

漏洞预警2026-08-06 发布INFO

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted messag...

CVE-2026-71447

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to di...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedde

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application re...

CVE-2026-71445

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary...

CVE-2026-71439

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.

历史摘要 · 未重新核验 · NVD

#cve #cwe-606 #cwe-1322

漏洞预警2026-08-06 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.ini...

CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-08-06 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vuln...

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-08-06 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulne...

CVE-2026-71436

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.

历史摘要 · 未重新核验 · NVD

#cve #cwe-835 #cwe-1325

漏洞预警2026-08-06 发布INFO

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Co...

CVE-2026-71434

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-08-06 发布INFO

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgre...

CVE-2026-71433

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-08-06 发布INFO

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using T...

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function

历史摘要 · 未重新核验 · NVD

#cve #cwe-617

漏洞预警2026-08-06 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNE...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default H

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-08-06 发布INFO

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchro...

CVE-2026-70640

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrap

历史摘要 · 未重新核验 · NVD

#cve #cwe-362 #cwe-476

漏洞预警2026-08-06 发布INFO

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the mo...

CVE-2026-70639

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper w

历史摘要 · 未重新核验 · NVD

#cve #cwe-476