2026-08-12 归档

今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。

漏洞预警2026-08-11 发布INFO

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The...

CVE-2026-72556

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by expl

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission c...

CVE-2026-72555

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.role

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers...

CVE-2026-72554

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-11 发布INFO

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persisten

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-11 发布INFO

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-...

CVE-2026-72551

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-11 发布INFO

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user...

CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the getten...

CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to ...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event org

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belongi...

CVE-2026-72546

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event org

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updateco...

CVE-2026-72545

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggereven...

CVE-2026-72544

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-11 发布INFO

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getconta...

CVE-2026-72543

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the work...

CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-11 发布INFO

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_re...

CVE-2026-72541

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace membe

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-11 发布INFO

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo...

CVE-2026-72540

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid prev

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-11 发布INFO

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain p...

CVE-2026-72539

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace mem

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The ...

CVE-2026-72538

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-11 发布INFO

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user accou...

CVE-2026-72537

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-11 发布INFO

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreat...

CVE-2026-72536

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mani

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-11 发布INFO

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the st...

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint

历史摘要 · 未重新核验 · NVD

#cve #cwe-306