2026-08-26 归档

今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-25 发布INFO

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, gorou...

CVE-2026-79777

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger p

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-08-25 发布INFO

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the git...

CVE-2026-79775

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the a

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-08-25 发布INFO

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with ...

CVE-2026-79774

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\Sec

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-08-25 发布INFO

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disc...

CVE-2026-79773

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an excepti...

CVE-2026-79772

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning

历史摘要 · 未重新核验 · NVD

#cve #cwe-252

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by p...

CVE-2026-79771

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strin

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. ...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokeniz

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone...

CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#in

历史摘要 · 未重新核验 · NVD

#cve #cwe-843

漏洞预警2026-08-25 发布INFO

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowin...

CVE-2026-79676

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths usin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attacke...

CVE-2026-79674

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositorie...

CVE-2026-70550

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under speci

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-25 发布INFO

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

CVE-2026-70548

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External De

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-25 发布INFO

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ...

CVE-2026-55582

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default se

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-25 发布INFO

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executab...

CVE-2026-55581

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Do

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-183 #cwe-1188

漏洞预警2026-08-25 发布INFO

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC...

CVE-2026-55580

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go init

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit ...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lack...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=a

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled lo...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-352

漏洞预警2026-08-25 发布INFO

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath co...

CVE-2025-71406

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-08-25 发布INFO

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables f...

CVE-2025-71346

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-

历史摘要 · 未重新核验 · NVD

#cve #cwe-125