2026-08-13 归档

今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-08-12 发布INFO

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not o...

CVE-2026-18744

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying th

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.

CVE-2026-17485

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-12 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

CVE-2026-10534

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-08-12 发布INFO

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-08-12 发布INFO

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its l...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-docum...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .ne...

CVE-2026-73425

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remo

历史摘要 · 未重新核验 · NVD

#cve #cwe-185

漏洞预警2026-08-12 发布INFO

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() prim...

CVE-2026-73423

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline install

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-12 发布INFO

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline ...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS ge

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, ...

CVE-2026-73419

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-346 #cwe-940

漏洞预警2026-08-12 发布INFO

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @aut...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-248

漏洞预警2026-08-12 发布INFO

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42...

CVE-2026-65370

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. Th

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences ...

CVE-2026-64826

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary file

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-12 发布INFO

Rejected reason: Voluntarily withdrawn

CVE-2026-62421

Rejected reason: Voluntarily withdrawn

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invali...

CVE-2026-19654

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input se

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-12 发布INFO

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A u...

CVE-2026-19503

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-12 发布INFO

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were wr...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, t

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-08-12 发布INFO

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue r...

CVE-2026-19004

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-12 发布INFO

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application pr...

CVE-2026-19002

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can resu

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-12 发布INFO

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application rea...

CVE-2026-18888

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-787