2026-08-12 归档

今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。

漏洞预警2026-08-11 发布INFO

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit...

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-11 发布INFO

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-...

CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker wi

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-11 发布INFO

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code e...

CVE-2026-67180

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-11 发布INFO

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAct...

CVE-2026-67179

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the develop

历史摘要 · 未重新核验 · NVD

#cve #cwe-644

漏洞预警2026-08-11 发布INFO

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attacker...

CVE-2026-56721

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's ...

CVE-2026-56720

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-11 发布INFO

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

CVE-2026-53416

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via loca

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-08-11 发布INFO

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

CVE-2026-53415

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code executio

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-08-11 发布INFO

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participa...

CVE-2026-53414

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting partic

历史摘要 · 未重新核验 · NVD

#cve #cwe-126

漏洞预警2026-08-11 发布INFO

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another partic...

CVE-2026-53413

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting parti

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-08-11 发布INFO

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the Ope...

CVE-2026-48766

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltr

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId...

CVE-2026-48495

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JS

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-11 发布INFO

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any...

CVE-2026-42142

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getShee

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-11 发布INFO

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the...

CVE-2026-19546

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed S

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-11 发布INFO

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remo...

CVE-2026-19078

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-11 发布INFO

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's dat...

CVE-2026-18640

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT perm

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-11 发布INFO

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without ver...

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, s

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-08-11 发布INFO

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a us...

CVE-2026-18638

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server proces

历史摘要 · 未重新核验 · NVD

#cve #cwe-476 #cwe-703

漏洞预警2026-08-11 发布INFO

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because t...

CVE-2026-14180

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-08-11 发布INFO

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the...

CVE-2026-11814

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to in

历史摘要 · 未重新核验 · NVD

#cve #cwe-295