Cyber Security Daily Radar

#cwe-78

共收录 1648 条相关情报。

← 返回所有主题
漏洞预警2026-06-29 发布INFO

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulatio...

CVE-2026-13545

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi

历史摘要 · 未重新核验 · NVD

#cve#cwe-77#cwe-78
安全公告2026-06-27 发布INFO

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply...

CVE-2026-55975

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-78#severity:high
安全公告2026-06-26 发布INFO

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

CVE-2026-55697

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-78#cwe-494#cwe-829#severity:high
漏洞预警2026-06-26 发布HIGH

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are i...

CVE-2026-55975

H.View IP摄像头存在一个由认证用户利用的XML注入漏洞。攻击者可以在证书生成接口中提交未经清理的XML字段，这些字段被直接拼接到后台证书创建命令中，由于缺乏适当的输入验证，可能导致在证书生成过程中以提升的权限执行任意命令。该漏洞的C

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布CRITICAL

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whit...

CVE-2026-49869

Kestra 是一个开源事件驱动编排平台。在 1.0.45 和 1.3.21 版本之前，其 AuthenticationFilter 使用 request.getPath().endsWith("/configs") 来将公开配置端点列入

历史摘要 · 未重新核验 · NVD

#cve#cwe-78#cwe-184#cwe-287#cwe-918#authentication-bypass
安全公告2026-06-26 发布INFO

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

CVE-2026-49260

### Summary `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `es

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#composer#cwe-78#severity:high
漏洞预警2026-06-26 发布INFO

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(a...

CVE-2026-48800

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters....

CVE-2026-48778

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::valu

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injec...

CVE-2026-32833

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authe

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust de...

CVE-2026-55448

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credent

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but t...

CVE-2026-55441

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config fil

历史摘要 · 未重新核验 · NVD

#cve#cwe-78#cwe-94#cwe-732
漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command...

CVE-2026-54636

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git re...

CVE-2026-45408

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell meta

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-26 发布INFO

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of ...

CVE-2026-40711

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-po

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
安全公告2026-06-26 发布INFO

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote...

CVE-2025-71336

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnera

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-78#severity:critical
漏洞预警2026-06-25 发布INFO

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to ex...

CVE-2025-71336

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnera

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
安全公告2026-06-25 发布INFO

ImageMagick: Policy Bypass can read disallowed files via symlink

CVE-2026-49219

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#nuget#cwe-22#cwe-78#cwe-200#cwe-863
漏洞预警2026-06-25 发布INFO

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication...

CVE-2026-54088

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · NVD

#cve#cwe-78#cwe-88#cwe-306
漏洞预警2026-06-25 发布INFO

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain n...

CVE-2026-46606

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine

历史摘要 · 未重新核验 · NVD

#cve#cwe-78
漏洞预警2026-06-25 发布INFO

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a reposito...

CVE-2026-55697

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.y

历史摘要 · 未重新核验 · NVD

#cve#cwe-78#cwe-494#cwe-829