2026-08-11 归档

今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client...

CVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in pack

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-c...

CVE-2026-72878

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline c

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker()...

CVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated w

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validati...

CVE-2026-72872

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider store

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore ...

CVE-2026-72869

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC s

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts b...

CVE-2026-72867

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-202

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-78 #cwe-602

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/bu...

CVE-2026-72865

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-termi...

CVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but n...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app te

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-639 #cwe-862

漏洞预警2026-08-10 发布INFO

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-10 发布INFO

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase in...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint a

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database servic...

CVE-2026-72862

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, pos

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitize...

CVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal...

CVE-2026-72736

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values d

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-con...

CVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/se

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from ...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC s

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path t...

CVE-2026-47754

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-862

漏洞预警2026-08-10 发布INFO

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatena...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-10 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affec...

CVE-2026-13206

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-10 发布INFO

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading,...

CVE-2026-72593

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-306