2026-08-13 归档

今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the...

CVE-2026-47232

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modu

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRi...

CVE-2026-47231

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-c

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-...

CVE-2026-47230

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_re

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enabl...

CVE-2026-47229

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash i...

CVE-2026-47228

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module th...

CVE-2026-47227

Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-08-12 发布INFO

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP...

CVE-2026-16999

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows S

历史摘要 · 未重新核验 · NVD

#cve #cwe-611

漏洞预警2026-08-12 发布INFO

In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity che...

CVE-2025-59327

In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, i

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from thes...

CVE-2025-59326

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file sys

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagMa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCO...

CVE-2026-53996

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unpr

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files fr...

CVE-2026-47226

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-12 发布INFO

Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML ...

CVE-2026-70560

Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-12 发布INFO

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request for...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later use

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-12 发布INFO

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an or...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status i

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing ...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-si

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, a...

CVE-2026-16747

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-08-12 发布INFO

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request ...

CVE-2026-15213

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-12 发布INFO

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, al...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against

历史摘要 · 未重新核验 · NVD

#cve #cwe-472