2026-08-12 归档

今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。

漏洞预警2026-08-10 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in...

CVE-2026-72915

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-10 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by ...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-be

历史摘要 · 未重新核验 · NVD

#cve #cwe-405 #cwe-770

漏洞预警2026-08-10 发布INFO

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size

历史摘要 · 未重新核验 · NVD

#cve #cwe-681

漏洞预警2026-08-10 发布INFO

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-c...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-10 发布INFO

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal contro...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

历史摘要 · 未重新核验 · NVD

#cve #cwe-150

漏洞预警2026-08-10 发布INFO

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authe...

CVE-2026-73033

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, all...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory func

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's std...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-93 #cwe-150

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_dat...

CVE-2026-72910

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, p

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of...

CVE-2026-72906

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction funct...

CVE-2026-72904

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78 #cwe-94 #cwe-95

漏洞预警2026-08-10 发布INFO

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In ...

CVE-2026-72903

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can retu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-10 发布INFO

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownF...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploi

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-10 发布INFO

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225c...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the defau

历史摘要 · 未重新核验 · NVD

#cve #cwe-506

漏洞预警2026-08-10 发布INFO

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a ...

CVE-2026-19411

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could al

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-08-10 发布INFO

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Thr...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-08-10 发布INFO

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the nati...

CVE-2026-18951

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly ag

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-10 发布INFO

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly valid...

CVE-2026-18950

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how Rol

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-10 发布INFO

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions gra...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-08-10 发布INFO

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that o...

CVE-2026-18947

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental

历史摘要 · 未重新核验 · NVD

#cve #cwe-862