2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-21 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP stre...

CVE-2026-62316

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-346

漏洞预警2026-08-21 发布INFO

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings with...

CVE-2026-61824

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:im

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-08-21 发布INFO

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting th...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

漏洞预警2026-08-21 发布INFO

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats ...

CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targ

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-21 发布INFO

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live applica...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-08-21 发布INFO

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /medi...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyO

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-942

漏洞预警2026-08-21 发布INFO

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled...

CVE-2026-53572

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constru

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-21 发布INFO

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvn...

CVE-2026-50538

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-787

漏洞预警2026-08-21 发布INFO

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used b...

CVE-2026-45271

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls im

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-08-21 发布INFO

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a ...

CVE-2026-45099

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-21 发布INFO

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirecto...

CVE-2026-44517

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/typ

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has bee...

CVE-2026-31880

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue ha...

CVE-2026-31803

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue ha...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This i...

CVE-2026-30865

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. Thi...

CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authoriz...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripti...

CVE-2026-74252

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from u...

CVE-2026-67362

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint a...

CVE-2026-67361

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-538