2026-08-13 归档

今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-08-12 发布INFO

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or tr...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on U

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-155

漏洞预警2026-08-12 发布INFO

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applicati...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/u

历史摘要 · 未重新核验 · NVD

#cve #cwe-116 #cwe-200

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values d...

CVE-2026-73409

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builde

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defa...

CVE-2026-73407

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUs...

CVE-2026-73406

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_EN

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by s...

CVE-2026-73332

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privile

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug val...

CVE-2026-73331

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the ema...

CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-08-12 发布INFO

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by ...

CVE-2026-73329

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected pl...

CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.use...

CVE-2026-73308

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts return

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values...

CVE-2026-73307

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts u

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/glob...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the fa

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-08-12 发布INFO

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authen...

CVE-2026-73303

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a cli

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-12 发布INFO

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdminis...

CVE-2026-72809

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth f

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-08-12 发布INFO

SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF...

CVE-2026-72808

SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-12 发布INFO

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL ...

CVE-2026-72807

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when renderi...

CVE-2026-72806

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-12 发布INFO

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document...

CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeI

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-12 发布INFO

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of passw...

CVE-2026-72804

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200