2026-08-25 归档

今日共收录 1135 条安全情报，包含 329 个 CVE，404 篇安全通告，以及 111 篇研究论文。

漏洞预警2026-08-24 发布INFO

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrin...

CVE-2026-78385

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-24 发布INFO

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-contr...

CVE-2026-78381

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-proces...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-24 发布INFO

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH p...

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlle

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-24 发布INFO

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

CVE-2026-78376

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-08-24 发布INFO

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized ...

CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-24 发布INFO

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain priv...

CVE-2026-78370

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated rem

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-24 发布INFO

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypt...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint p

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-contr...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-24 发布INFO

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to inf...

CVE-2026-78250

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component

历史摘要 · 未重新核验 · NVD

#cve #cwe-404 #cwe-835

漏洞预警2026-08-24 发布INFO

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. Th...

CVE-2026-78248

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-24 发布INFO

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accoun...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctEx...

CVE-2026-76848

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validati

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-24 发布INFO

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including Cr...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact

历史摘要 · 未重新核验 · NVD

#cve #cwe-321 #cwe-862

漏洞预警2026-08-24 发布INFO

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an ar...

CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforc

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-24 发布INFO

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed characte...

CVE-2026-76844

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_fil...

CVE-2026-76843

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-24 发布INFO

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive in...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding th

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass t...

CVE-2026-76841

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 expos

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-24 发布INFO

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in ...

CVE-2026-59567

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an un

历史摘要 · 未重新核验 · NVD

#cve #cwe-280