2026-08-14 归档

今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。

漏洞预警2026-08-13 发布INFO

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can...

CVE-2026-73607

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-13 发布INFO

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthe...

CVE-2026-73606

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without valida...

CVE-2026-73605

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anony

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authentic...

CVE-2026-73604

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthen...

CVE-2026-73603

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale ...

CVE-2026-73602

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-08-13 发布INFO

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to exec...

CVE-2026-73601

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTO

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-08-13 发布INFO

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticate...

CVE-2026-73488

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via promp...

CVE-2026-73487

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows una

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code...

CVE-2026-73486

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the p...

CVE-2026-73485

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-13 发布INFO

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query....

CVE-2026-73484

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-08-13 发布INFO

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with acces...

CVE-2026-73483

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/no

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-13 发布INFO

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, ca...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input para

历史摘要 · 未重新核验 · NVD

#cve #cwe-705 #cwe-755

漏洞预警2026-08-13 发布INFO

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-13 发布INFO

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privilege...

CVE-2026-16455

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-08-13 发布INFO

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML va...

CVE-2026-12263

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an au

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-08-13 发布INFO

CWE-284: Improper Access Control

CVE-2026-59505

CWE-284: Improper Access Control

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-13 发布INFO

CWE-203: Observable Discrepancy

CVE-2026-59502

CWE-203: Observable Discrepancy

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-08-13 发布INFO

CWE-284: Improper Access Control

CVE-2026-59501

CWE-284: Improper Access Control

历史摘要 · 未重新核验 · NVD

#cve #cwe-284