2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

← 返回归档列表

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's o...

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query pa...

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increme...

CVE-2026-67358

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-639

漏洞预警2026-08-21 发布INFO

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), f...

CVE-2026-62960

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bun

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-610

漏洞预警2026-08-21 发布INFO

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex,...

CVE-2026-50290

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization strippe

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without ...

CVE-2026-50288

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a pars

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version...

CVE-2026-30866

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-306

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with ...

CVE-2026-30819

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-rando...

CVE-2026-27490

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being

历史摘要 · 未重新核验 · NVD

#cve #cwe-330 #cwe-331

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has...

CVE-2026-27463

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the logi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset p...

CVE-2026-27462

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/inval

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-08-21 发布INFO

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpel...

CVE-2026-77795

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceControl

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-285

漏洞预警2026-08-21 发布INFO

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to ...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-08-21 发布INFO

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value ...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsy

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-21 发布INFO

Rejected reason: reserved but not needed

CVE-2026-56875

Rejected reason: reserved but not needed

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-21 发布INFO

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-sup...

CVE-2026-55850

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/comp

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatM...

CVE-2026-54682

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoj...

CVE-2026-54681

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporte

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-21 发布INFO

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse re...

CVE-2026-54134

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custo

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-21 发布INFO

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs ...

CVE-2026-54073

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidde

历史摘要 · 未重新核验 · NVD

#cve #cwe-693