SecLens 情报中心

社区情报

来自安全社区、研究机构和开源生态的情报。

go/go.etcd.io/etcd/v3: etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

发布时间 2026-07-25 06:40 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

Severity: HIGH | Package: go/go.etcd.io/etcd/v3 | Affected: >= 3.7.0-alpha.0, < 3.7.1 | Patched: 3.7.1

扩展字段

{
  "cwe_ids": [
    "CWE-770"
  ],
  "cwe_names": [
    "Allocation of Resources Without Limits or Throttling"
  ],
  "ghsa_id": "GHSA-6vch-q96h-7gc3",
  "package": {
    "ecosystem": "go",
    "name": "go.etcd.io/etcd/v3",
    "patched_version": "3.7.1",
    "vulnerable_range": ">= 3.7.0-alpha.0, < 3.7.1"
  },
  "references": [
    "https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3",
    "https://github.com/etcd-io/etcd/pull/22130",
    "https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2",
    "https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057",
    "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
    "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
    "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
    "https://github.com/advisories/GHSA-6vch-q96h-7gc3"
  ],
  "source_code_location": "https://github.com/etcd-io/etcd",
  "updated_at": "2026-07-24T22:40:18Z"
}

GitHub Advisory ecosystem:go severity:high type:reviewed github_advisory official_bulletin package_vulnerability

npm/@frontmcp/adapters: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

发布时间 2026-07-25 06:40 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.9 | Package: npm/@frontmcp/adapters | Affected: <= 1.5.5 | Patched: 1.5.6

扩展字段

{
  "credits": [
    {
      "login": "EchoSkorJjj",
      "type": "finder"
    },
    {
      "login": "frontegg-david",
      "type": "remediation_developer"
    }
  ],
  "cvss_score": 5.9,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cwe_ids": [
    "CWE-918"
  ],
  "cwe_names": [
    "Server-Side Request Forgery (SSRF)"
  ],
  "ghsa_id": "GHSA-8q49-2h5h-434x",
  "package": {
    "ecosystem": "npm",
    "name": "@frontmcp/adapters",
    "patched_version": "1.5.6",
    "vulnerable_range": "<= 1.5.5"
  },
  "references": [
    "https://github.com/agentfront/frontmcp/security/advisories/GHSA-8q49-2h5h-434x",
    "https://github.com/agentfront/frontmcp/pull/510",
    "https://github.com/agentfront/frontmcp/commit/077201e109bf6f45dbc85c36d6bd77ded18ab13e",
    "https://github.com/agentfront/frontmcp/releases/tag/v1.5.6",
    "https://github.com/advisories/GHSA-8q49-2h5h-434x"
  ],
  "source_code_location": "https://github.com/agentfront/frontmcp",
  "updated_at": "2026-07-24T22:40:00Z"
}

GitHub Advisory ecosystem:npm severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

go/github.com/getkin/kin-openapi: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

发布时间 2026-07-25 06:39 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.3 | Package: go/github.com/getkin/kin-openapi | Affected: <= 0.143.0 | Patched: 0.144.0

扩展字段

{
  "credits": [
    {
      "login": "matiasinsaurralde",
      "type": "reporter"
    }
  ],
  "cvss_score": 5.3,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe_ids": [
    "CWE-476"
  ],
  "cwe_names": [
    "NULL Pointer Dereference"
  ],
  "ghsa_id": "GHSA-jpcw-4wr7-c3vq",
  "package": {
    "ecosystem": "go",
    "name": "github.com/getkin/kin-openapi",
    "patched_version": "0.144.0",
    "vulnerable_range": "<= 0.143.0"
  },
  "references": [
    "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq",
    "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64",
    "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0",
    "https://github.com/advisories/GHSA-jpcw-4wr7-c3vq"
  ],
  "source_code_location": "https://github.com/getkin/kin-openapi",
  "updated_at": "2026-07-24T22:39:40Z"
}

GitHub Advisory ecosystem:go severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

pip/bedrock-agentcore: AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

发布时间 2026-07-25 06:38 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

扩展字段

{
  "credits": [
    {
      "login": "MrCloudSec",
      "type": "finder"
    }
  ],
  "cve_id": "CVE-2026-16796",
  "cvss_score": 7.3,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
  "cwe_ids": [
    "CWE-88"
  ],
  "cwe_names": [
    "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"
  ],
  "ghsa_id": "GHSA-j6g5-3hh3-pgw8",
  "package": {
    "ecosystem": "pip",
    "name": "bedrock-agentcore",
    "patched_version": "1.18.1",
    "vulnerable_range": "< 1.18.1"
  },
  "references": [
    "https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-16796",
    "https://github.com/aws/bedrock-agentcore-sdk-python/pull/581",
    "https://github.com/aws/bedrock-agentcore-sdk-python/commit/3c4b4ee6b8730e6313a82c743ac37dbcc1c21cdb",
    "https://aws.amazon.com/security/security-bulletins/2026-065-aws",
    "https://pypi.org/project/bedrock-agentcore/1.18.1",
    "https://github.com/advisories/GHSA-j6g5-3hh3-pgw8"
  ],
  "source_code_location": "https://github.com/aws/bedrock-agentcore-sdk-python",
  "updated_at": "2026-07-24T22:38:57Z"
}

GitHub Advisory ecosystem:pip severity:high type:reviewed cve github_advisory official_bulletin package_vulnerability

go/go.etcd.io/etcd/v3: etcd: Watch API authorization bypass via open-ended range requests

发布时间 2026-07-25 06:38 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

Severity: HIGH | Package: go/go.etcd.io/etcd/v3 | Affected: >= 3.7.0-alpha.0, < 3.7.1 | Patched: 3.7.1

扩展字段

{
  "credits": [
    {
      "login": "lobuhi",
      "type": "reporter"
    },
    {
      "login": "AdamKorcz",
      "type": "reporter"
    }
  ],
  "cwe_ids": [
    "CWE-863"
  ],
  "cwe_names": [
    "Incorrect Authorization"
  ],
  "ghsa_id": "GHSA-xg4h-6gfc-h4m8",
  "package": {
    "ecosystem": "go",
    "name": "go.etcd.io/etcd/v3",
    "patched_version": "3.7.1",
    "vulnerable_range": ">= 3.7.0-alpha.0, < 3.7.1"
  },
  "references": [
    "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8",
    "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41",
    "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae",
    "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7",
    "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
    "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
    "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
    "https://github.com/advisories/GHSA-xg4h-6gfc-h4m8"
  ],
  "source_code_location": "https://github.com/etcd-io/etcd",
  "updated_at": "2026-07-24T22:38:25Z"
}

GitHub Advisory ecosystem:go severity:high type:reviewed github_advisory official_bulletin package_vulnerability

rust/aws-smithy-http-server: Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

发布时间 2026-07-25 06:37 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

扩展字段

{
  "cve_id": "CVE-2026-16756",
  "cvss_score": 7.5,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe_ids": [
    "CWE-770"
  ],
  "cwe_names": [
    "Allocation of Resources Without Limits or Throttling"
  ],
  "ghsa_id": "GHSA-jvxp-qmx7-gjpx",
  "package": {
    "ecosystem": "rust",
    "name": "aws-smithy-http-server",
    "patched_version": "0.66.5",
    "vulnerable_range": "<= 0.66.4"
  },
  "references": [
    "https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-16756",
    "https://aws.amazon.com/security/security-bulletins/2026-064-aws",
    "https://crates.io/crates/aws-smithy-http-server/0.66.5",
    "https://github.com/advisories/GHSA-jvxp-qmx7-gjpx"
  ],
  "source_code_location": "https://github.com/smithy-lang/smithy-rs",
  "updated_at": "2026-07-24T22:37:39Z"
}

GitHub Advisory ecosystem:rust severity:high type:reviewed cve github_advisory official_bulletin package_vulnerability

pip/libp2p: libp2p: yamux connection DoS via oversized data frame

发布时间 2026-07-25 06:37 (UTC+08:00) 抓取时间 2026-07-25 06:45 (UTC+08:00)

Severity: HIGH | CVSS: 7.5 | Package: pip/libp2p | Affected: <= 0.6.0

扩展字段

{
  "credits": [
    {
      "login": "tahaafarooq",
      "type": "reporter"
    }
  ],
  "cvss_score": 7.5,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe_ids": [
    "CWE-400"
  ],
  "cwe_names": [
    "Uncontrolled Resource Consumption"
  ],
  "ghsa_id": "GHSA-hmj8-5xmh-5573",
  "package": {
    "ecosystem": "pip",
    "name": "libp2p",
    "patched_version": null,
    "vulnerable_range": "<= 0.6.0"
  },
  "references": [
    "https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573",
    "https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37",
    "https://github.com/advisories/GHSA-hmj8-5xmh-5573"
  ],
  "source_code_location": "https://github.com/libp2p/py-libp2p",
  "updated_at": "2026-07-24T22:37:17Z"
}

GitHub Advisory ecosystem:pip severity:high type:reviewed github_advisory official_bulletin package_vulnerability

npm/quasar: Quasar: Prototype pollution in the extend() utility

发布时间 2026-07-25 06:36 (UTC+08:00) 抓取时间 2026-07-25 08:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.6 | Package: npm/quasar | Affected: <= 2.21.4 | Patched: 2.22.0

扩展字段

{
  "credits": [
    {
      "login": "Dremig",
      "type": "reporter"
    }
  ],
  "cvss_score": 5.6,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "cwe_ids": [
    "CWE-1321"
  ],
  "cwe_names": [
    "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
  ],
  "ghsa_id": "GHSA-3r53-75j5-3g7j",
  "package": {
    "ecosystem": "npm",
    "name": "quasar",
    "patched_version": "2.22.0",
    "vulnerable_range": "<= 2.21.4"
  },
  "references": [
    "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j",
    "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7",
    "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
    "https://github.com/advisories/GHSA-3r53-75j5-3g7j"
  ],
  "source_code_location": "https://github.com/quasarframework/quasar",
  "updated_at": "2026-07-24T22:36:47Z"
}

GitHub Advisory ecosystem:npm severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

全部来源 Cloudflare 博客腾讯云安全公告 Adobe 安全公告阿里云 AVD Ubuntu 安全通告启明星辰安全通告 Amazon Linux AL2 公告 Amazon Linux AL2023 公告 AWS 安全公告 MSRC 更新指南 Oracle 安全警报 Apple 安全更新 Chrome 稳定版更新 Red Hat 安全公告 Atlassian 安全公告 NVIDIA 安全公告华为安全公告联想安全公告阿里云 Linux 安全公告阿里云 Linux CVE 通知阿里云安全公告 Amazon Linux 1 (EOL)安全公告 Amazon Linux 安全公告长亭漏洞库 Seebug 漏洞库 CISA KEV Catalog 微步银狐情报微步银狐 IOC Ransomware.live 近期受害者工信部 CNVDB CNNVD 通报 CNNVD 漏洞库 CNVD 漏洞库 TC260 标准征求意见 Seebug 技术 Paper GitHub Advisory HackerOne 博客 Exploit-DB 安天每日安全简讯 LinuxSecurity Hybrid VulDB 地方采购（CCGP）中央采购（CCGP） The Hacker News FreeBuf 社区 VIPRead 嘶吼安全资讯 Doonsec 微信聚合 arXiv cs.CR RSA Conference Podcast 新闻聚焦社区动态会议与培训融资快讯并购整合情报快报事件通报工具更新产品发布

社区情报

订阅来源 RSS