Cyber Security Daily Radar

#advisory

共收录 23779 条相关情报。

← 返回所有主题
安全公告2026-07-20 发布INFO

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-770
安全公告2026-07-20 发布INFO

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

CVE-2026-45713

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-400#cwe-770
安全公告2026-07-20 发布INFO

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?dat

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-362#cwe-770
安全公告2026-07-20 发布INFO

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name`

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-124
安全公告2026-07-20 发布INFO

Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c

CVE-2026-26197

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is cor

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-125
安全公告2026-07-20 发布INFO

The application evaluate UNC path in workspace name

CVE-2026-25039

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanit

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-40
安全公告2026-07-20 发布INFO

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

CVE-2026-45711

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-22#cwe-829
安全公告2026-07-20 发布INFO

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side R

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-918
安全公告2026-07-20 发布INFO

Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)

CVE-2026-46516

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-79
安全公告2026-07-20 发布INFO

ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-r

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-126#cwe-190
安全公告2026-07-20 发布INFO

ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

CVE-2026-63090

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allo

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-122
安全公告2026-07-20 发布INFO

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-22#cwe-23
安全公告2026-07-20 发布INFO

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` a

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-208
安全公告2026-07-20 发布INFO

FileBrowser Quantum: unauthenticated user share share info

CVE-2026-46410

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may le

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-07-20 发布INFO

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-79
安全公告2026-07-20 发布INFO

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enfo

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-73
安全公告2026-07-20 发布INFO

Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-347
安全公告2026-07-20 发布INFO

Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-862
安全公告2026-07-20 发布INFO

FreeRDP before 3.28.0 Double-Free via selectedmonitors

CVE-2026-64621

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_appl

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-415
安全公告2026-07-20 发布INFO

FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

CVE-2026-64620

FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server s

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-122