2026-08-14 归档

今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-08-13 发布INFO

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the mi...

CVE-2026-73663

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-13 发布INFO

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-l

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-13 发布INFO

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none ...

CVE-2026-73661

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-08-13 发布INFO

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HT...

CVE-2026-73660

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-13 发布INFO

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts ...

CVE-2026-73659

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet pres

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-13 发布INFO

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign()...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5,

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-862

漏洞预警2026-08-13 发布INFO

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/...

CVE-2026-73657

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-345 #cwe-639

漏洞预警2026-08-13 发布INFO

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 t...

CVE-2026-73489

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-08-13 发布INFO

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape seque...

CVE-2026-73479

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-08-13 发布INFO

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into...

CVE-2026-73428

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-13 发布INFO

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth ob...

CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-636

漏洞预警2026-08-13 发布INFO

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-...

CVE-2026-73420

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-08-13 发布INFO

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab all...

CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-08-13 发布INFO

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/...

CVE-2026-73416

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

#cve #cwe-178 #cwe-180

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a D...

CVE-2026-73408

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multip

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId ...

CVE-2026-73305

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRo

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-862 #cwe-863

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/ut...

CVE-2026-73304

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVeri...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-13 发布INFO

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status reco...

CVE-2026-73039

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-522