2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-20 发布INFO

Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chrom...

CVE-2026-76017

Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary cod

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-08-20 发布INFO

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into ...

CVE-2026-75484

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated r

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-08-20 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream proces...

CVE-2026-74836

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote at

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-08-20 发布INFO

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this...

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A te

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-20 发布INFO

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from sav...

CVE-2026-73040

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-20 发布INFO

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrus...

CVE-2026-70654

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unus

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-20 发布INFO

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat ...

CVE-2026-70653

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE de

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-20 发布INFO

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvip...

CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahd

历史摘要 · 未重新核验 · NVD

#cve #cwe-126

漏洞预警2026-08-20 发布INFO

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline vali...

CVE-2026-69242

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF proc

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-190

漏洞预警2026-08-20 发布INFO

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in...

CVE-2026-68921

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-184

漏洞预警2026-08-20 发布INFO

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensio...

CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attach

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-08-20 发布INFO

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadS...

CVE-2026-67445

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/s

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-08-20 发布INFO

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system...

CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-20 发布INFO

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a mani...

CVE-2026-77151

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-310 #cwe-327

漏洞预警2026-08-20 发布INFO

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in ...

CVE-2026-72861

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-08-20 发布INFO

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype...

CVE-2026-66002

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and Pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-204

漏洞预警2026-08-20 发布INFO

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization ...

CVE-2026-63003

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-20 发布INFO

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior ...

CVE-2026-53586

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522 #cwe-601

漏洞预警2026-08-20 发布INFO

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting...

CVE-2026-73254

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-20 发布INFO

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_...

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are c

历史摘要 · 未重新核验 · NVD

#cve #cwe-150