2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-21 发布INFO

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to ...

CVE-2026-59279

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of session

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-08-21 发布INFO

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attacker...

CVE-2026-19848

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before renderin

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-08-21 发布INFO

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's e...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-08-21 发布INFO

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, co...

CVE-2026-17559

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which RE

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-21 发布INFO

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated att...

CVE-2026-16650

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-21 发布INFO

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, all...

CVE-2026-15046

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-21 发布INFO

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level acces...

CVE-2026-13176

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify eve

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-21 发布INFO

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without thei...

CVE-2026-77767

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user ho

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-21 发布INFO

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key), which returned ei...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived e

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-21 发布INFO

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from...

CVE-2026-77761

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be ret

历史摘要 · 未重新核验 · NVD

#cve #cwe-459

漏洞预警2026-08-21 发布INFO

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the...

CVE-2026-77686

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php o

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-285

漏洞预警2026-08-21 发布INFO

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation shou...

CVE-2026-59296

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a danger

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-08-21 发布INFO

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoi...

CVE-2026-15576

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass m

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-21 发布INFO

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to...

CVE-2026-14208

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-08-21 发布INFO

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit() to handle sev...

CVE-2026-77755

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 docum

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-21 发布INFO

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's ob...

CVE-2026-77751

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-ST

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-21 发布INFO

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipula...

CVE-2026-77681

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown function

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-08-21 发布INFO

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extract...

CVE-2026-59323

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-08-21 发布INFO

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xml_buil...

CVE-2026-48590

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-91

漏洞预警2026-08-21 发布INFO

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities

CVE-2026-47827

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell comma

历史摘要 · 未重新核验 · NVD

#cve #cwe-77