2026-08-12 归档

今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。

漏洞预警2026-08-11 发布INFO

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cau...

CVE-2026-72610

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arb...

CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute ...

CVE-2026-72608

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read ar...

CVE-2026-72607

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or exter...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-11 发布INFO

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint....

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-11 发布INFO

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file dele...

CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-11 发布INFO

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem ...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissi

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the se

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-11 发布INFO

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network ...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cas...

CVE-2026-72596

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete pos

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsContr...

CVE-2026-72595

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update tic

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsContro...

CVE-2026-72563

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id colu...

CVE-2026-72562

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OID...

CVE-2026-72561

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-UR...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTI

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-11 发布INFO

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered witho...

CVE-2026-72559

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-11 发布INFO

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates...

CVE-2026-72558

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. T...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extensi

历史摘要 · 未重新核验 · NVD

#cve #cwe-434