2026-08-08 归档

今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-08-06 发布INFO

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did n...

CVE-2026-64662

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-06 发布INFO

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, cod...

CVE-2026-64654

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-08-06 发布INFO

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path ...

CVE-2026-64653

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-06 发布INFO

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained pers...

CVE-2026-64652

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characte

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-08-06 发布INFO

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup direct...

CVE-2026-63725

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a ta

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-06 发布INFO

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL withou...

CVE-2026-63637

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-06 发布INFO

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal ...

CVE-2026-61632

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-06 发布INFO

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it...

CVE-2026-5856

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no pack

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-06 发布INFO

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffe...

CVE-2026-5855

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer lengt

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-06 发布INFO

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it,...

CVE-2026-5336

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template ren

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-1336

漏洞预警2026-08-06 发布INFO

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list ...

CVE-2026-54717

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticate...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-06 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via s...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-06 发布INFO

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allow...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported co

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-06 发布INFO

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attemp...

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-08-06 发布INFO