2026-08-15 归档

今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。

漏洞预警2026-08-14 发布INFO

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee ...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-798

漏洞预警2026-08-14 发布INFO

A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipu...

CVE-2026-19830

A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-08-14 发布INFO

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File...

CVE-2026-19829

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-14 发布INFO

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The ...

CVE-2026-19828

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file Pla

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-14 发布INFO

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDet...

CVE-2026-19827

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-14 发布INFO

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with sett...

CVE-2026-19768

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 20

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-14 发布INFO

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission ...

CVE-2026-19870

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-14 发布INFO

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the c...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-502

漏洞预警2026-08-14 发布INFO

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=s...

CVE-2026-19825

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element i

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-14 发布INFO

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing...

CVE-2026-19824

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMac

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-08-14 发布INFO

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule D...

CVE-2026-19823

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleD

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-08-14 发布INFO

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachab...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-203

漏洞预警2026-08-14 发布INFO

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: ch...

CVE-2026-73051

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts re

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-08-14 发布INFO

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the vi...

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-14 发布INFO

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations w...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-14 发布INFO

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by ...

CVE-2026-72859

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-14 发布INFO

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data t...

CVE-2026-72838

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-08-14 发布INFO

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authentica...

CVE-2026-72837

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-14 发布INFO

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are e...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership duri

历史摘要 · 未重新核验 · NVD

#cve #cwe-178

漏洞预警2026-08-14 发布INFO

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using cas...

CVE-2026-72835

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated u

历史摘要 · 未重新核验 · NVD

#cve #cwe-41