Boletim diário
Boletim de segurança
Carregando a edição...
Agregado automaticamente, sem curadoria humana, a partir de fontes públicas: CISA KEV, NVD, GitHub Advisories, EQSTLab e CERT-EU. Cada alerta leva à sua fonte oficial.
252 alertas neste dia, todos listados abaixo.
Incluídas no catálogo KEV da CISA: há evidência de ataques reais. Priorize a correção.
CVE-2015-5477
ISC · BIND
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CVE-2016-3081
Apache · Struts
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CVE-2023-22894
Strapi · Strapi
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or...
CVE-2021-3199
ONLYOFFICE · Docs
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
CVE-2015-3306
ProFTPD · ProFTPD
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVE-2026-96207
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed...
Agregado automaticamente, sem curadoria humana, a partir de fontes públicas: CISA KEV, NVD, GitHub Advisories, EQSTLab e CERT-EU. Cada alerta leva à sua fonte oficial.
CVE-2026-61447
pip · praisonaiagents
CodeAgent.executepython() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set. This allows an attacker who can influence LLM...
CVE-2026-12260
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract...
CVE-2026-94510
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-61445
pip · praisonai
The AICoder UI component exposes writetofile and executecommand tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorizedkeys, /etc/crontab) and arbitrary command execution through prompt...
CVE-2026-106126
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
CVE-2026-88131
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
CVE-2026-77900
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
CVE-2026-61434
pip · praisonai
The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ( ;|&<$()${} ) and uses spawn() with...
CVE-2026-19482
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.
CVE-2026-18740
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.
CVE-2026-101024
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitation could result in...
CVE-2026-106433
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid...
CVE-2026-107375
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated...
CVE-2026-105436
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.