SecLens 情报中心

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-21470257",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-11922",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 3,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1\n\n链接:https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "ZenML是ZenML公司开源的一个可扩展的开源 MLOps 框架,用于创建可移植的、可用于生产的机器学习管道。\nZenML 0.57.0版本至0.94.2版本存在授权问题漏洞，该漏洞源于通过旋转`X-Forwarded-For`标头可绕过速率限制，导致身份验证端点容易受到凭证猜测攻击。",
  "vul_type": "0",
  "vul_type_name": "授权问题"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-22541495",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-50517",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 1,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50517",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft 365 copilot是美国Microsoft公司的一款AI生产力工具。\nMicrosoft 365 copilot存在反序列化注入漏洞，该漏洞源于未对不可信数据进行反序列化，可能导致授权攻击者通过网络执行代码。",
  "vul_type": "0",
  "vul_type_name": "注入"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-31281378",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-54120",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 1,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54120",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft Surface Management Services是美国Microsoft公司的一款集中式IT设备管理解决方案。\nMicrosoft Surface Management Services存在输入验证错误漏洞，该漏洞源于输入验证不当，可能导致授权攻击者通过网络执行代码。",
  "vul_type": "0",
  "vul_type_name": "输入验证错误"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-33174458",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-56165",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 1,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft account是美国Microsoft公司的一个用户身份配置对象。\nMicrosoft Account存在缓冲区错误漏洞，该漏洞源于堆缓冲区溢出，可能导致未经授权的攻击者通过网络执行代码。",
  "vul_type": "0",
  "vul_type_name": "缓冲区错误"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-39486350",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-49159",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 3,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49159",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft graph是美国Microsoft公司的一种图形数据管理服务。\nMicrosoft Graph存在信息泄露漏洞，该漏洞源于敏感信息暴露给未授权参与者，可能导致授权攻击者通过网络披露信息。",
  "vul_type": "0",
  "vul_type_name": "信息泄露"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-58562210",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-35425",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 2,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft Microsoft Azure API Management是美国Microsoft公司的一款API管理平台。\nMicrosoft Azure API Management存在权限许可和访问控制问题漏洞，该漏洞源于访问控制不当，可能允许授权的攻击者通过网络执行代码。",
  "vul_type": "0",
  "vul_type_name": "权限许可和访问控制问题"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-59688841",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-13464",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 3,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/CollectionController.php#L117\n\n链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/CollectionController.php#L33\n\n链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L39\n\n链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/CollectionController.php#L117\n\n链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/CollectionController.php#L33\n\n链接:https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/FrontendRESTController.php#L39\n\n链接:https://plugins.trac.wordpress.org/changeset?reponame=&old=3617070%40kirki&new=3617070%40kirki\n\n链接:https://www.wordfence.com/threat-intel/vulnerabilities/id/84f65255-f710-44f9-9f77-61776a40abae?source=cve",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "WordPress Kirki是WordPress基金会的一款适用于 WordPress 的自由形式可视化构建器和高级主题定制器。\nWordPress Kirki 6.0.14及之前版本存在授权问题漏洞，该漏洞源于对context参数中用户控制键验证不足，导致不安全的直接对象引用，可能使得未经身份验证的攻击者读取任意WordPress帖子的标题、内容和摘要。",
  "vul_type": "0",
  "vul_type_name": "授权问题"
}

{
  "affected_vendor": "",
  "cnnvd_code": "CNNVD-2026-67740567",
  "create_time": "2026-07-24",
  "cve_code": "CVE-2026-58275",
  "detailed_publish_time": "2026-07-24 00:00:00",
  "detailed_update_time": "2026-07-24 00:00:00",
  "hazard_level": 1,
  "is_official": 1,
  "publish_time": "2026-07-24",
  "refer_url": "链接:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58275",
  "update_time": "2026-07-26",
  "vendor": null,
  "vul_desc": "Microsoft Azure DNS是美国Microsoft公司的一款DNS管理服务。\nMicrosoft Azure DNS存在授权问题漏洞，该漏洞源于授权缺失，可能导致未经授权的攻击者通过网络提升权限。",
  "vul_type": "0",
  "vul_type_name": "授权问题"
}