2026-08-25 归档

今日共收录 1135 条安全情报，包含 329 个 CVE，404 篇安全通告，以及 111 篇研究论文。

漏洞预警2026-08-24 发布INFO

A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project direc...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other use...

CVE-2026-67204

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-u

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-24 发布INFO

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documente...

CVE-2026-21752

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or

历史摘要 · 未重新核验 · NVD

#cve #cwe-1104

漏洞预警2026-08-24 发布INFO

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and ...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-24 发布INFO

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the d...

CVE-2026-13212

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-08-24 发布INFO

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of pr...

CVE-2026-12556

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-08-24 发布INFO

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of pr...

CVE-2026-12555

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-379

漏洞预警2026-08-24 发布INFO

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of pr...

CVE-2026-12554

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-1104

漏洞预警2026-08-24 发布INFO

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal com...

CVE-2025-68825

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, conta

历史摘要 · 未重新核验 · NVD

#cve #cwe-276

漏洞预警2026-08-24 发布INFO

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace ...

CVE-2026-9728

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->si

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-08-24 发布INFO

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to ...

CVE-2026-78414

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux,

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-24 发布INFO

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from ex...

CVE-2026-78391

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocu

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-24 发布INFO

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session bu...

CVE-2026-78387

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config en

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-24 发布INFO

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a fi...

CVE-2026-76055

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackdu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-24 发布INFO

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's bu...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an a

历史摘要 · 未重新核验 · NVD

#cve #cwe-214

漏洞预警2026-08-24 发布INFO

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender()...

CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without esca

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-24 发布INFO

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized c...

CVE-2026-39915

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP hea

历史摘要 · 未重新核验 · NVD

#cve #cwe-113

漏洞预警2026-08-24 发布INFO

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export...

CVE-2026-39914

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arb

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-24 发布INFO

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.

CVE-2026-21755

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or creden

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-08-24 发布INFO

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets ...

CVE-2026-78386

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Locati

历史摘要 · 未重新核验 · NVD

#cve #cwe-200