2026-08-20 归档

今日共收录 1886 条安全情报，包含 1062 个 CVE，406 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-19 发布INFO

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request...

CVE-2026-62671

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-19 发布INFO

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/Fl...

CVE-2026-62670

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-se...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhoo...

CVE-2026-62668

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores ...

CVE-2026-62667

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generat...

CVE-2026-62666

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-19 发布INFO

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode,...

CVE-2026-61842

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to ret

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-19 发布INFO

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() wi...

CVE-2026-61690

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipA

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in Handl...

CVE-2026-61607

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2,

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated r...

CVE-2026-53654

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redir

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framew...

CVE-2026-46343

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secur...

CVE-2026-44254

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-131 #cwe-787

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wa...

CVE-2026-44253

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-770 #cwe-789

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user wi...

CVE-2026-44252

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, W

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../ev...

CVE-2026-19672

The tarfile module's tar and data extraction filters created directories outside the destination for members whose nam

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-19 发布INFO

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to ...

CVE-2026-18430

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race con...

CVE-2026-16819

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise d

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-08-19 发布INFO

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler wit...

CVE-2026-76614

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel PO

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-19 发布INFO

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound...

CVE-2026-76203

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-08-19 发布INFO

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Array/non-numeric valu...

CVE-2026-75956

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Paginati

历史摘要 · 未重新核验 · NVD

#cve #cwe-770