2026-08-19 归档

今日共收录 2403 条安全情报，包含 1575 个 CVE，408 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-17 发布INFO

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-08-17 发布INFO

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and he...

CVE-2026-67960

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-17 发布INFO

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to...

CVE-2026-67868

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMo

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-17 发布INFO

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

CVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-17 发布INFO

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhoo...

CVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-17 发布INFO

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component

CVE-2026-51977

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-321

漏洞预警2026-08-17 发布INFO

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies t...

CVE-2026-42163

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoper

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-17 发布INFO

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_...

CVE-2026-75110

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=

历史摘要 · 未重新核验 · NVD

#cve #cwe-697

漏洞预警2026-08-17 发布INFO

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for an...

CVE-2026-75106

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, al

历史摘要 · 未重新核验 · NVD

#cve #cwe-340

漏洞预警2026-08-17 发布INFO

Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819

CVE-2026-67967

Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an in

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-08-17 发布INFO

Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.

CVE-2026-67966

Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemo

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-17 发布INFO

An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function

CVE-2026-67965

An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-17 发布INFO

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module

CVE-2026-67926

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-17 发布INFO

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` fil...

CVE-2026-67917

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-17 发布INFO

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspe...

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic impr

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-17 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe ex...

CVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-08-17 发布INFO

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around da...

CVE-2026-47698

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stac

历史摘要 · 未重新核验 · NVD

#cve #cwe-913

漏洞预警2026-08-17 发布INFO

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and Aggrega...

CVE-2026-47686

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes Suppr

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-08-17 发布INFO

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dup_wcs components

CVE-2026-39255

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-08-17 发布INFO

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceGetDescr...

CVE-2026-39254

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via

历史摘要 · 未重新核验 · NVD

#cve #cwe-120