2026-08-20 归档

今日共收录 1886 条安全情报，包含 1062 个 CVE，406 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-19 发布INFO

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authentic...

CVE-2026-75616

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing c

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-19 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the p...

CVE-2026-75596

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the defau

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-08-19 发布INFO

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong ...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.h

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-08-19 发布INFO

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or s...

CVE-2026-75569

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-08-19 发布INFO

Tanium addressed a compression bomb vulnerability in Threat Response.

CVE-2026-75476

Tanium addressed a compression bomb vulnerability in Threat Response.

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-08-19 发布INFO

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.leng...

CVE-2026-69222

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-19 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without c...

CVE-2026-68555

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedl

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-19 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN ...

CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append att

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-924

漏洞预警2026-08-19 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or...

CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can pla

历史摘要 · 未重新核验 · NVD

#cve #cwe-134

漏洞预警2026-08-19 发布INFO

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length...

CVE-2026-68552

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client c

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-19 发布INFO

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges loca...

CVE-2026-62727

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-08-19 发布INFO

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinit...

CVE-2026-61556

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the stri

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment b...

CVE-2026-54743

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Mark

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that send...

CVE-2026-54741

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private me

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a si...

CVE-2026-54740

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moder

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different err...

CVE-2026-54739

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in cra

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For ...

CVE-2026-54738

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-799

漏洞预警2026-08-19 发布INFO

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES...

CVE-2026-54494

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_va

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-19 发布INFO

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept a...

CVE-2026-54493

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-19 发布INFO

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because...

CVE-2026-54492

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view

历史摘要 · 未重新核验 · NVD

#cve #cwe-918