2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-21 发布INFO

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrato...

CVE-2026-53529

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor per...

CVE-2026-53528

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset re

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-08-21 发布INFO

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own acco...

CVE-2026-53527

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user upda

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-21 发布INFO

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a ...

CVE-2026-53509

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools incl

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-21 发布INFO

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which e...

CVE-2026-53497

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359

漏洞预警2026-08-21 发布INFO

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by se...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/ove

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attri...

CVE-2026-53468

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQT...

CVE-2026-43980

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc7609508355

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without check...

CVE-2026-34836

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env...

CVE-2026-34741

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated rem

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

CVE-2026-33333

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. Th...

CVE-2026-33240

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in ver...

CVE-2026-33047

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not ass

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fix...

CVE-2026-31936

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object informat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards save...

CVE-2026-77811

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary c...

CVE-2026-77415

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain s

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-21 发布INFO

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted exp...

CVE-2026-77414

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup fun

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-21 发布INFO

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed c...

CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lack

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-21 发布INFO

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-contro...

CVE-2026-77354

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in op

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-789

漏洞预警2026-08-21 发布INFO

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionar...

CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a

历史摘要 · 未重新核验 · NVD

#cve #cwe-825