2026-08-11 归档

今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。

漏洞预警2026-08-10 发布INFO

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated a...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

历史摘要 · 未重新核验 · NVD

#cve #cwe-180 #cwe-287

漏洞预警2026-08-10 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/pri...

CVE-2026-72916

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

历史摘要 · 未重新核验 · NVD

#cve #cwe-918 #cwe-1286

漏洞预警2026-08-10 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in...

CVE-2026-72915

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-10 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by ...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

历史摘要 · 未重新核验 · NVD

#cve #cwe-405 #cwe-770

漏洞预警2026-08-10 发布INFO

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size

历史摘要 · 未重新核验 · NVD

#cve #cwe-681

漏洞预警2026-08-10 发布INFO

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-c...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-10 发布INFO

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal contro...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-08-10 发布INFO

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authe...

CVE-2026-73033

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, all...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory func

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's std...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-93 #cwe-150

漏洞预警2026-08-10 发布INFO

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side ...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-rec

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1333

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_dat...

CVE-2026-72910

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, p

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.p...

CVE-2026-72908

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissio...

CVE-2026-72907

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of...

CVE-2026-72906

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Rejected reason: Further research determined the issue is not a vulnerability.

CVE-2026-72905

Rejected reason: Further research determined the issue is not a vulnerability.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-10 发布INFO

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction funct...

CVE-2026-72904

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78 #cwe-94 #cwe-95

漏洞预警2026-08-10 发布INFO

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In ...

CVE-2026-72903

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can retu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html wit...

CVE-2026-72743

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashb

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-10 发布INFO

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownF...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploi

历史摘要 · 未重新核验 · NVD

#cve #cwe-59