2026-08-20 归档

今日共收录 1886 条安全情报，包含 1062 个 CVE，406 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-19 发布INFO

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template paramete...

CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-19 发布INFO

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-f...

CVE-2026-76217

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-19 发布INFO

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permiss...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve res...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the muta...

CVE-2026-76214

phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareFor

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful passwor...

CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure count

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsql.php b...

CVE-2026-76212

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE

历史摘要 · 未重新核验 · NVD

#cve #cwe-88

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allow...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elas

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <...

CVE-2026-76210

phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker wit

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-19 发布INFO

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabl...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the...

CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP au

历史摘要 · 未重新核验 · NVD

#cve #cwe-778

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid crede...

CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-08-19 发布INFO

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access...

CVE-2026-76206

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL lite...

CVE-2026-76205

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by trunc

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-19 发布INFO

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenti...

CVE-2026-75920

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing s

历史摘要 · 未重新核验 · NVD

#cve #cwe-377

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuratio...

CVE-2026-75919

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at ...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled.

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-19 发布INFO

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by ...

CVE-2026-75917

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a ...

CVE-2026-75916

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclo...

CVE-2026-75148

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_valid

历史摘要 · 未重新核验 · NVD

#cve #cwe-190