2026-08-22 归档

今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-20 发布INFO

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel...

CVE-2026-72844

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value bein

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-08-20 发布INFO

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_addres...

CVE-2026-63388

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in b

历史摘要 · 未重新核验 · NVD

#cve #cwe-617 #cwe-787

漏洞预警2026-08-20 发布INFO

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encode...

CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-08-20 发布INFO

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buff...

CVE-2026-63381

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c wh

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-08-20 发布INFO

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider...

CVE-2026-53425

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-20 发布INFO

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly....

CVE-2026-53424

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject

历史摘要 · 未重新核验 · NVD

#cve #cwe-294

漏洞预警2026-08-20 发布INFO

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due...

CVE-2026-2334

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-08-20 发布INFO

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient valid...

CVE-2026-77176

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection,

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-20 发布INFO

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php...

CVE-2026-77020

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is a

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-20 发布INFO

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob i...

CVE-2026-65842

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while con

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-20 发布INFO

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.r...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier,

历史摘要 · 未重新核验 · NVD

#cve #cwe-201

漏洞预警2026-08-20 发布INFO

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c....

CVE-2026-55586

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffm

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-787

漏洞预警2026-08-20 发布INFO

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog f...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-20 发布INFO

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequ...

CVE-2026-54449

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or

历史摘要 · 未重新核验 · NVD

#cve #cwe-77

漏洞预警2026-08-20 发布INFO

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script conten...

CVE-2026-54136

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.71

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-20 发布INFO

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeI...

CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-08-20 发布INFO

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GI...

CVE-2026-18309

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-20 发布INFO

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIM...

CVE-2026-18308

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-190

漏洞预警2026-08-20 发布INFO

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati...

CVE-2026-18307

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-20 发布INFO

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIM...

CVE-2026-18306

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-190