2026-08-14 归档

今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。

← 返回归档列表

漏洞预警2026-08-13 发布INFO

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.in...

CVE-2026-73628

Serendipity versions >= 2.3.5 and ). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-13 发布INFO

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow ...

CVE-2026-73627

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement byp

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-08-13 发布INFO

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed...

CVE-2026-73626

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.i

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-13 发布INFO

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-char...

CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-13 发布INFO

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attacker...

CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fail

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-13 发布INFO

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-13 发布INFO

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplyin...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handl

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-13 发布INFO

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_op...

CVE-2026-73621

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keywor

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-13 发布INFO

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers c...

CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-13 发布INFO

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these ...

CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file an

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-13 发布INFO

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query te...

CVE-2026-73618

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where use

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-13 发布INFO

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscapin...

CVE-2026-73617

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplie

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-08-13 发布INFO

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with w...

CVE-2026-73616

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor toke...

CVE-2026-73615

Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw comm

历史摘要 · 未重新核验 · NVD

#cve #cwe-436

漏洞预警2026-08-13 发布INFO

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. ...

CVE-2026-73614

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns,

历史摘要 · 未重新核验 · NVD

#cve #cwe-436

漏洞预警2026-08-13 发布INFO

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Crea...

CVE-2026-73613

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-bas...

CVE-2026-73612

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete op

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys saniti...

CVE-2026-73610

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish...

CVE-2026-73609

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that ret

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-13 发布INFO

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /...

CVE-2026-73608

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-862