2026-08-15 归档

今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI...

CVE-2026-17182

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

CVE-2026-17181

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-14 发布INFO

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS c...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-14 发布INFO

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authenti...

CVE-2026-50027

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/document

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-14 发布INFO

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify sig...

CVE-2026-49457

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-297

漏洞预警2026-08-14 发布INFO

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed ...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-14 发布INFO

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vuln...

CVE-2026-48528

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 th

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-287

漏洞预警2026-08-14 发布INFO

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying ope...

CVE-2026-19682

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-14 发布INFO

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially craft...

CVE-2026-19681

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-14 发布INFO

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by ...

CVE-2026-19626

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-95

漏洞预警2026-08-14 发布INFO

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the sc...

CVE-2026-72829

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-targe...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subs

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-08-14 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSupe...

CVE-2026-72824

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::gua

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-14 发布INFO

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa en...

CVE-2026-72822

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on t

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-14 发布INFO

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title,...

CVE-2026-72811

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backl

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-14 发布INFO

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-640

漏洞预警2026-08-13 发布INFO

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled ...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXE

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-13 发布INFO

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Atta...

CVE-2026-72850

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-13 发布INFO

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authori...

CVE-2026-72842

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access b

历史摘要 · 未重新核验 · NVD

#cve #cwe-73