2026-08-21 归档

今日共收录 1701 条安全情报，包含 827 个 CVE，444 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-08-20 发布INFO

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-20 发布INFO

Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

CVE-2026-69855

Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information o

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-20 发布INFO

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-20 发布INFO

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

CVE-2026-69543

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-20 发布INFO

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

CVE-2026-69519

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-08-20 发布INFO

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

CVE-2026-69419

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a net

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-20 发布INFO

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix wh...

CVE-2026-67448

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin mid

历史摘要 · 未重新核验 · NVD

#cve #cwe-177 #cwe-200 #cwe-346

漏洞预警2026-08-20 发布INFO

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before appl...

CVE-2026-67447

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-08-20 发布INFO

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

CVE-2026-66800

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-20 发布INFO

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for...

CVE-2026-64773

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-20 发布INFO

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values ...

CVE-2026-62945

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-contr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-20 发布INFO

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instructi...

CVE-2026-55894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() f

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-08-20 发布INFO

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg(...

CVE-2026-55893

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-20 发布INFO

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections withou...

CVE-2026-55769

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-08-20 发布INFO

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords i...

CVE-2026-55765

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and

历史摘要 · 未重新核验 · NVD

#cve #cwe-256 #cwe-522

漏洞预警2026-08-20 发布INFO

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when ge...

CVE-2026-55491

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-20 发布INFO

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation be...

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentation

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-20 发布INFO

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.

CVE-2026-55015

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-08-20 发布INFO

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.

CVE-2026-55013

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locall

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-08-20 发布INFO

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareL...

CVE-2026-54509

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src

历史摘要 · 未重新核验 · NVD

#cve #cwe-862