2026-08-14 归档

今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-08-13 发布INFO

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively c...

CVE-2026-73647

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-08-13 发布INFO

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total sup...

CVE-2026-73645

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-13 发布INFO

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on ...

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-08-13 发布INFO

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multi...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until

历史摘要 · 未重新核验 · NVD

#cve #cwe-776

漏洞预警2026-08-13 发布INFO

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an at...

CVE-2026-73568

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming()

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-13 发布INFO

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path...

CVE-2026-73566

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-674

漏洞预警2026-08-13 发布INFO

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed S...

CVE-2026-73565

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request t

历史摘要 · 未重新核验 · NVD

#cve #cwe-401 #cwe-770

漏洞预警2026-08-13 发布INFO

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @bac...

CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registra

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-13 发布INFO

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as...

CVE-2026-73562

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-08-13 发布INFO

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListene...

CVE-2026-73561

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSoc

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-13 发布INFO

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources ...

CVE-2026-72741

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsaniti...

CVE-2026-67613

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitra

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-13 发布INFO

The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common ...

CVE-2026-19730

The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TR

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-08-13 发布INFO

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary ...

CVE-2026-18428

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-08-13 发布INFO

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been re...

CVE-2026-12908

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-13 发布INFO

The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during ...

CVE-2026-12236

The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-08-13 发布INFO

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resou...

CVE-2024-58374

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows r

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-13 发布INFO

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parame...

CVE-2019-25765

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-13 发布INFO

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labe...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-08-13 发布INFO

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

历史摘要 · 未重新核验 · NVD

#cve #cwe-918