2026-08-26 归档

今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to a...

CVE-2024-58377

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. No

历史摘要 · 未重新核验 · NVD

#cve #cwe-427

漏洞预警2026-08-25 发布INFO

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema proce...

CVE-2023-54354

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-08-25 发布INFO

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory write...

CVE-2022-50999

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-08-25 发布INFO

Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity...

CVE-2022-50998

Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-08-25 发布INFO

Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in...

CVE-2021-47996

Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, w

历史摘要 · 未重新核验 · NVD

#cve #cwe-119

漏洞预警2026-08-25 发布INFO

A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions...

CVE-2026-79717

A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-25 发布INFO

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.

CVE-2026-70551

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data U

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-25 发布INFO

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state change...

CVE-2026-69104

An authenticated user may initiate repository migration operations without required repository permissions, potentially

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-25 发布INFO

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate i...

CVE-2026-55624

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8,

历史摘要 · 未重新核验 · NVD

#cve #cwe-670

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unifi...

CVE-2026-55541

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified p

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. ...

CVE-2026-55540

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() ra

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authenticate POST /agents o...

CVE-2026-55538

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because th...

CVE-2026-55537

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webh

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-705 #cwe-918

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated addres...

CVE-2026-55535

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents...

CVE-2026-55534

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key bu

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not ...

CVE-2026-55531

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=Fal...

CVE-2026-55530

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval d

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-contr...

CVE-2026-55529

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-346

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route....

CVE-2026-55528

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token bu

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or pat...

CVE-2026-55527

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized u

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73