2026-08-23 归档

今日共收录 968 条安全情报，包含 250 个 CVE，385 篇安全通告，以及 68 篇研究论文。

漏洞预警2026-08-22 发布INFO

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypas...

CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit wa

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-08-22 发布INFO

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root ...

CVE-2026-62385

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-22 发布INFO

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers c...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-22 发布INFO

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can p...

CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-22 发布INFO

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its optio...

CVE-2026-75870

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared

历史摘要 · 未重新核验 · NVD

#cve #cwe-1394

漏洞预警2026-08-22 发布INFO

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAu...

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant t

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-22 发布INFO

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read fr...

CVE-2026-71514

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the c

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-22 发布INFO

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers ...

CVE-2026-71513

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle m

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-22 发布INFO

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-68769

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-22 发布INFO

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due ...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of da

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-22 发布INFO

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'te...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form respon

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-22 发布INFO

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and includi...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dela

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-22 发布INFO

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This i...

CVE-2026-2996

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-22 发布INFO

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against curre...

CVE-2026-62382

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion log

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-22 发布INFO

luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. Fo...

CVE-2026-62381

luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-08-22 发布INFO

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain nul

历史摘要 · 未重新核验 · NVD

#cve #cwe-626

漏洞预警2026-08-22 发布INFO

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL cli...

CVE-2026-62243

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable

历史摘要 · 未重新核验 · NVD

#cve #cwe-297

漏洞预警2026-08-22 发布INFO

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwri...

CVE-2026-62204

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-08-22 发布INFO

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed direc...

CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-22 发布INFO

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Aut...

CVE-2026-60083

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to

历史摘要 · 未重新核验 · NVD

#cve #cwe-863