Linux Kernel權限提升漏洞

發佈日期: 2026年05月04日

風險: 中度風險

類型: 操作系統 - LINUX

於 Linux Kernel 發現一個漏洞。本地攻擊者可利用這個漏洞，於目標系統觸發權限提升。

 

注意:

CVE-2026-31431 正在被廣泛利用。Copy Fail（CVE-2026-31431）是 Linux 核心中 authencesn 密碼學範本的一項邏輯漏洞。此漏洞可能使未具特權的本機使用者，對系統上任何可讀取檔案的頁面快取執行可控的四位元組寫入。對於自 2017 年起發佈的受影響 Linux 發行版而言，此問題可能導致本機權限提升，包括取得 root 權限。

---

影響

• 權限提升

---

受影響之系統或技術

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html
• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html
• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

漏洞識別碼

• CVE-2026-31431

---

資料來源

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html
• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

相關連結

• https://ubuntu.com/security/CVE-2026-31431
• https://security-tracker.debian.org/tracker/CVE-2026-31431
• https://access.redhat.com/security/cve/cve-2026-31431
• https://www.suse.com/security/cve/CVE-2026-31431.html
• https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• https://security.archlinux.org/CVE-2026-31431
• https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431
• https://copy.fail/
• https://xint.io/blog/copy-fail-linux-distributions
• https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog
• 
  

Linux Kernel Elevation of Privilege Vulnerability

Release Date: 4 May 2026

RISK: Medium Risk

TYPE: Operating Systems - Linux

A vulnerability was identified in Linux Kernel. A local attacker can exploit this vulnerability to trigger elevation of privilege on the targeted system.

 

Note: 

CVE-2026-31431 is being exploited in the wild. Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel's authencesn cryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.

---

Impact

• Elevation of Privilege

---

System / Technologies affected

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html

• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html
• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

Vulnerability Identifier

• CVE-2026-31431

---

Source

• Ubuntu: https://ubuntu.com/security/CVE-2026-31431
• Debian: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Red Hat: https://access.redhat.com/security/cve/cve-2026-31431
• SUSE: https://www.suse.com/security/cve/CVE-2026-31431.html
• Amazon:https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• Arch：https://security.archlinux.org/CVE-2026-31431
• AlmaLinux: https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• Cloudlinux: https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431

---

Related Link

• https://ubuntu.com/security/CVE-2026-31431
• https://security-tracker.debian.org/tracker/CVE-2026-31431
• https://access.redhat.com/security/cve/cve-2026-31431
• https://www.suse.com/security/cve/CVE-2026-31431.html
• https://explore.alas.aws.amazon.com/CVE-2026-31431.html
• https://security.archlinux.org/CVE-2026-31431
• https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
• https://blog.cloudlinux.com/cve-2026-31431-copy-fail-mitigation-and-patches
• https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-31431
• https://copy.fail/
• https://xint.io/blog/copy-fail-linux-distributions
• https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog

Microsoft Edge 多個漏洞

發佈日期: 2026年05月04日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、阻斷服務狀況、繞過保安限制、資料篡改及洩露敏感資料。

---

影響

• 資料洩露
• 繞過保安限制
• 遠端執行程式碼
• 阻斷服務
• 篡改

---

受影響之系統或技術

• Microsoft Edge 147.0.3912.98 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 147.0.3912.98 或之後版本

---

漏洞識別碼

• CVE-2026-7333
• CVE-2026-7334
• CVE-2026-7335
• CVE-2026-7336
• CVE-2026-7337
• CVE-2026-7338
• CVE-2026-7339
• CVE-2026-7340
• CVE-2026-7341
• CVE-2026-7343
• CVE-2026-7344
• CVE-2026-7345
• CVE-2026-7346
• CVE-2026-7347
• CVE-2026-7348
• CVE-2026-7349
• CVE-2026-7350
• CVE-2026-7351
• CVE-2026-7353
• CVE-2026-7354
• CVE-2026-7355
• CVE-2026-7356
• CVE-2026-7357
• CVE-2026-7358
• CVE-2026-7359
• CVE-2026-7360
• CVE-2026-7363

---

資料來源

• Microsoft Edge

---

相關連結

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7333
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7334
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7335
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7336
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7337
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7338
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7339
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7340
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7341
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7343
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7344
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7345
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7346
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7347
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7348
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7349
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7350
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7351
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7353
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7354
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7355
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7356
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7357
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7358
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7359
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7360
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7363
• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-30-2026

Microsoft Edge Multiple Vulnerabilities

Release Date: 4 May 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, denial of service condition, security restriction bypass, data manipulation and sensitive information disclosure on the targeted system.

---

Impact

• Information Disclosure
• Security Restriction Bypass
• Remote Code Execution
• Denial of Service
• Data Manipulation

---

System / Technologies affected

• Microsoft Edge version prior to 147.0.3912.98

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 147.0.3912.98 or later

---

Vulnerability Identifier

• CVE-2026-7333
• CVE-2026-7334
• CVE-2026-7335
• CVE-2026-7336
• CVE-2026-7337
• CVE-2026-7338
• CVE-2026-7339
• CVE-2026-7340
• CVE-2026-7341
• CVE-2026-7343
• CVE-2026-7344
• CVE-2026-7345
• CVE-2026-7346
• CVE-2026-7347
• CVE-2026-7348
• CVE-2026-7349
• CVE-2026-7350
• CVE-2026-7351
• CVE-2026-7353
• CVE-2026-7354
• CVE-2026-7355
• CVE-2026-7356
• CVE-2026-7357
• CVE-2026-7358
• CVE-2026-7359
• CVE-2026-7360
• CVE-2026-7363

---

Source

• Microsoft Edge

---

Related Link

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7333
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7334
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7335
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7336
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7337
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7338
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7339
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7340
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7341
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7343
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7344
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7345
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7346
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7347
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7348
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7349
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7350
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7351
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7353
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7354
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7355
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7356
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7357
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7358
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7359
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7360
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7363
• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-30-2026

Mozilla Thunderbird 多個漏洞

發佈日期: 2026年05月04日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla Thunderbird 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發敏感資料洩露、遠端執行任意程式碼及繞過保安限制。

 

---

影響

• 遠端執行程式碼
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Thunderbird 140.10.1
• Thunderbird 150.0.1

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Thunderbird 140.10.1
• Thunderbird 150.0.1

 

---

漏洞識別碼

• CVE-2026-7320
• CVE-2026-7321
• CVE-2026-7322
• CVE-2026-7323
• CVE-2026-7324

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-38/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-39/

Mozilla Thunderbird Multiple Vulnerabilities

Release Date: 4 May 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Thunderbird.  A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure, remote code execution and security restriction bypass on the targeted system.

---

Impact

• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

Versions prior to:

 

• Thunderbird 140.10.1
• Thunderbird 150.0.1

 

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Thunderbird 140.10.1
• Thunderbird 150.0.1

---

Vulnerability Identifier

• CVE-2026-7320
• CVE-2026-7321
• CVE-2026-7322
• CVE-2026-7323
• CVE-2026-7324

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-38/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-39/

QNAP NAS 權限提升漏洞

發佈日期: 2026年05月04日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 QNAP NAS 發現一個漏洞。本地攻擊者可利用這個漏洞，於目標系統觸發權限提升。

 

注意:

CVE-2026-31431 正在被廣泛利用。一項稱為 「Copy Fail」 的本機權限提升漏洞，會影響 Linux 核心。如果被利用，此漏洞可能允許經過身份驗證、具有程式碼執行功能的非管理員使用者獲得提升的系統權限。

---

影響

• 權限提升

---

受影響之系統或技術

• QTS on specific QNAP ARM64 NAS models running Kernel 5.10

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.qnap.com/en/security-advisory/qsa-26-16

---

漏洞識別碼

• CVE-2026-31431

---

資料來源

• QNAP

---

相關連結

• https://www.qnap.com/en/security-advisory/qsa-26-16

QNAP NAS Elevation of Privilege Vulnerability

Release Date: 4 May 2026

RISK: Medium Risk

TYPE: Servers - Other Servers

A vulnerability was identified in QNAP NAS. A local attacker can exploit this vulnerability to trigger elevation of privilege on the targeted system.

 

Note: 

CVE-2026-31431 is being exploited in the wild. A local privilege escalation vulnerability, commonly known as "Copy Fail", has been reported to affect the Linux kernel. If exploited, this vulnerability could allow an authenticated, non-administrator user with code execution capabilities to obtain elevated system privileges.

---

Impact

• Elevation of Privilege

---

System / Technologies affected

• QTS on specific QNAP ARM64 NAS models running Kernel 5.10

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.qnap.com/en/security-advisory/qsa-26-16

---

Vulnerability Identifier

• CVE-2026-31431

---

Source

• QNAP

---

Related Link

• https://www.qnap.com/en/security-advisory/qsa-26-16

MongoDB 多個漏洞

發佈日期: 2026年04月30日

風險: 中度風險

類型: 伺服器 - 數據庫伺服器

於 MongoDB 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發資料篡改、阻斷服務狀況及繞過保安限制。

---

影響

• 阻斷服務
• 篡改
• 繞過保安限制

---

受影響之系統或技術

• MongoDB Server 7.0.0 至 7.0.32 之前的版本

• MongoDB Server 8.0.0 至 8.0.21 之前的版本
• MongoDB Server 8.1.* 及之前的版本
• MongoDB Server 8.2.0 至 8.2.7 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝供應商提供的修補程式：

 

• https://www.mongodb.com/resources/products/alerts#security

---

漏洞識別碼

• CVE-2026-6914
• CVE-2026-6915

---

資料來源

• MongoDB

---

相關連結

• https://www.mongodb.com/resources/products/alerts#security
• https://jira.mongodb.org/browse/SERVER-119679
• https://jira.mongodb.org/browse/SERVER-119981

MongoDB Multiple Vulnerabilities

Release Date: 30 Apr 2026

RISK: Medium Risk

TYPE: Servers - Database Servers

Multiple vulnerabilities were identified in MongoDB. A remote attacker could exploit some of these vulnerabilities to trigger data manipulation, denial of service condition and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Data Manipulation
• Security Restriction Bypass

---

System / Technologies affected

• MongoDB Server 7.0.0 versions prior to 7.0.32
• MongoDB Server 8.0.0 versions prior to 8.0.21
• MongoDB Server 8.1.* and prior versions
• MongoDB Server 8.2.0 versions prior to 8.2.7

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• https://www.mongodb.com/resources/products/alerts#security

---

Vulnerability Identifier

• CVE-2026-6914
• CVE-2026-6915

---

Source

• MongoDB

---

Related Link

• https://www.mongodb.com/resources/products/alerts#security
• https://jira.mongodb.org/browse/SERVER-119679
• https://jira.mongodb.org/browse/SERVER-119981

Google Chrome 多個漏洞

發佈日期: 2026年04月29日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、阻斷服務狀況、繞過保安限制、資料篡改及洩露敏感資料。

 

---

影響

• 資料洩露
• 阻斷服務
• 遠端執行程式碼
• 繞過保安限制
• 篡改

---

受影響之系統或技術

• Google Chrome 147.0.7727.137 (Linux) 之前的版本
• Google Chrome 147.0.7727.137/138 (Mac) 之前的版本
• Google Chrome 147.0.7727.137/138 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 147.0.7727.137 (Linux) 或之後版本
• 更新至 147.0.7727.137/138 (Mac) 或之後版本
• 更新至 147.0.7727.137/138 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2026-7333
• CVE-2026-7334
• CVE-2026-7335
• CVE-2026-7336
• CVE-2026-7337
• CVE-2026-7338
• CVE-2026-7339
• CVE-2026-7340
• CVE-2026-7341
• CVE-2026-7342
• CVE-2026-7343
• CVE-2026-7344
• CVE-2026-7345
• CVE-2026-7346
• CVE-2026-7347
• CVE-2026-7348
• CVE-2026-7349
• CVE-2026-7350
• CVE-2026-7351
• CVE-2026-7352
• CVE-2026-7353
• CVE-2026-7354
• CVE-2026-7355
• CVE-2026-7356
• CVE-2026-7357
• CVE-2026-7358
• CVE-2026-7359
• CVE-2026-7360
• CVE-2026-7361
• CVE-2026-7363

---

資料來源

• Google Chrome

---

相關連結

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html

Google Chrome Multiple Vulnerabilities

Release Date: 29 Apr 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, denial of service condition, security restriction bypass, data manipulation and sensitive information disclosure on the targeted system.

---

Impact

• Information Disclosure
• Denial of Service
• Remote Code Execution
• Security Restriction Bypass
• Data Manipulation

---

System / Technologies affected

• Google Chrome prior to 147.0.7727.137 (Linux)
• Google Chrome prior to 147.0.7727.137/138 (Mac)
• Google Chrome prior to 147.0.7727.137/138 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 147.0.7727.137 (Linux) or later
• Update to version 147.0.7727.137/138 (Mac) or later
• Update to version 147.0.7727.137/138 (Windows) or later

---

Vulnerability Identifier

• CVE-2026-7333
• CVE-2026-7334
• CVE-2026-7335
• CVE-2026-7336
• CVE-2026-7337
• CVE-2026-7338
• CVE-2026-7339
• CVE-2026-7340
• CVE-2026-7341
• CVE-2026-7342
• CVE-2026-7343
• CVE-2026-7344
• CVE-2026-7345
• CVE-2026-7346
• CVE-2026-7347
• CVE-2026-7348
• CVE-2026-7349
• CVE-2026-7350
• CVE-2026-7351
• CVE-2026-7352
• CVE-2026-7353
• CVE-2026-7354
• CVE-2026-7355
• CVE-2026-7356
• CVE-2026-7357
• CVE-2026-7358
• CVE-2026-7359
• CVE-2026-7360
• CVE-2026-7361
• CVE-2026-7363

---

Source

• Google Chrome

---

Related Link

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html

Microsoft Edge 多個漏洞

發佈日期: 2026年04月29日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制及洩露敏感資料。

---

影響

• 資料洩露
• 繞過保安限制

---

受影響之系統或技術

• Microsoft Edge 147.0.3912.87 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 147.0.3912.87 或之後版本

---

漏洞識別碼

• CVE-2026-6919
• CVE-2026-6920

---

資料來源

• Microsoft Edge

---

相關連結

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6919
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6920

Microsoft Edge Multiple Vulnerabilities

Release Date: 29 Apr 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass and sensitive information disclosure on the targeted system.

---

Impact

• Information Disclosure
• Security Restriction Bypass

---

System / Technologies affected

• Microsoft Edge version prior to 147.0.3912.87

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 147.0.3912.87 or later

---

Vulnerability Identifier

• CVE-2026-6919
• CVE-2026-6920

---

Source

• Microsoft Edge

---

Related Link

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6919
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6920

Mozilla Firefox 多個漏洞

發佈日期: 2026年04月29日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla Firefox 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料、繞過保安限制及遠端執行任意程式碼。

 

---

影響

• 遠端執行程式碼
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Firefox 150.0.1
• Firefox ESR 115.35.1
• Firefox ESR 140.10.1

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Firefox 150.0.1
• Firefox ESR 115.35.1
• Firefox ESR 140.10.1

---

漏洞識別碼

• CVE-2026-7320
• CVE-2026-7321
• CVE-2026-7322
• CVE-2026-7323
• CVE-2026-7324

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-35/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-36/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-37/

Mozilla Firefox Multiple Vulnerabilities

Release Date: 29 Apr 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Firefox. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure, security restriction bypass and remote code execution on the targeted system.

---

Impact

• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

Versions prior to:

 

• Firefox 150.0.1
• Firefox ESR 115.35.1
• Firefox ESR 140.10.1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Firefox 150.0.1
• Firefox ESR 115.35.1
• Firefox ESR 140.10.1

---

Vulnerability Identifier

• CVE-2026-7320
• CVE-2026-7321
• CVE-2026-7322
• CVE-2026-7323
• CVE-2026-7324

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-35/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-36/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-37/

ChromeOS 多個漏洞

發佈日期: 2026年04月28日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發資料篡改、阻斷服務狀況、遠端執行任意程式碼、洩露敏感資料及繞過保安限制。

---

影響

• 遠端執行程式碼
• 阻斷服務
• 資料洩露
• 繞過保安限制
• 篡改

---

受影響之系統或技術

• ChromeOS 16610.44.0 （瀏覽器版本 147.0.7727.115） 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式，詳情請參閱以下連結：

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-chromeos_22.html

---

漏洞識別碼

• CVE-2026-5858
• CVE-2026-5859
• CVE-2026-5860
• CVE-2026-5861
• CVE-2026-5862
• CVE-2026-5863
• CVE-2026-5864
• CVE-2026-5865
• CVE-2026-5866
• CVE-2026-5867
• CVE-2026-5869
• CVE-2026-5870
• CVE-2026-5871
• CVE-2026-5872
• CVE-2026-5873
• CVE-2026-5874
• CVE-2026-5875
• CVE-2026-5876
• CVE-2026-5877
• CVE-2026-5878
• CVE-2026-5880
• CVE-2026-5881
• CVE-2026-5882
• CVE-2026-5883
• CVE-2026-5884
• CVE-2026-5888
• CVE-2026-5889
• CVE-2026-5890
• CVE-2026-5891
• CVE-2026-5892
• CVE-2026-5893
• CVE-2026-5894
• CVE-2026-5896
• CVE-2026-5899
• CVE-2026-5900
• CVE-2026-5901
• CVE-2026-5903
• CVE-2026-5904
• CVE-2026-5907
• CVE-2026-5908
• CVE-2026-5909
• CVE-2026-5910
• CVE-2026-5911
• CVE-2026-5912
• CVE-2026-5913
• CVE-2026-5915
• CVE-2026-6296
• CVE-2026-6297
• CVE-2026-6298
• CVE-2026-6299
• CVE-2026-6300
• CVE-2026-6301
• CVE-2026-6302
• CVE-2026-6303
• CVE-2026-6304
• CVE-2026-6305
• CVE-2026-6306
• CVE-2026-6307
• CVE-2026-6308
• CVE-2026-6309
• CVE-2026-6312
• CVE-2026-6313
• CVE-2026-6314
• CVE-2026-6316
• CVE-2026-6317
• CVE-2026-6318
• CVE-2026-6360
• CVE-2026-6362
• CVE-2026-6363
• CVE-2026-6364
• CVE-2026-6919

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-chromeos_22.html

ChromeOS Multiple Vulnerabilities

Release Date: 28 Apr 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger data manipulation, denial of service condition, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

---

Impact

• Remote Code Execution
• Denial of Service
• Information Disclosure
• Security Restriction Bypass
• Data Manipulation

---

System / Technologies affected

• ChromeOS versions prior to 16610.44.0 (Browser version 147.0.7727.115)

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor. For detail, please refer to the link below:

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-chromeos_22.html

---

Vulnerability Identifier

• CVE-2026-5858
• CVE-2026-5859
• CVE-2026-5860
• CVE-2026-5861
• CVE-2026-5862
• CVE-2026-5863
• CVE-2026-5864
• CVE-2026-5865
• CVE-2026-5866
• CVE-2026-5867
• CVE-2026-5869
• CVE-2026-5870
• CVE-2026-5871
• CVE-2026-5872
• CVE-2026-5873
• CVE-2026-5874
• CVE-2026-5875
• CVE-2026-5876
• CVE-2026-5877
• CVE-2026-5878
• CVE-2026-5880
• CVE-2026-5881
• CVE-2026-5882
• CVE-2026-5883
• CVE-2026-5884
• CVE-2026-5888
• CVE-2026-5889
• CVE-2026-5890
• CVE-2026-5891
• CVE-2026-5892
• CVE-2026-5893
• CVE-2026-5894
• CVE-2026-5896
• CVE-2026-5899
• CVE-2026-5900
• CVE-2026-5901
• CVE-2026-5903
• CVE-2026-5904
• CVE-2026-5907
• CVE-2026-5908
• CVE-2026-5909
• CVE-2026-5910
• CVE-2026-5911
• CVE-2026-5912
• CVE-2026-5913
• CVE-2026-5915
• CVE-2026-6296
• CVE-2026-6297
• CVE-2026-6298
• CVE-2026-6299
• CVE-2026-6300
• CVE-2026-6301
• CVE-2026-6302
• CVE-2026-6303
• CVE-2026-6304
• CVE-2026-6305
• CVE-2026-6306
• CVE-2026-6307
• CVE-2026-6308
• CVE-2026-6309
• CVE-2026-6312
• CVE-2026-6313
• CVE-2026-6314
• CVE-2026-6316
• CVE-2026-6317
• CVE-2026-6318
• CVE-2026-6360
• CVE-2026-6362
• CVE-2026-6363
• CVE-2026-6364
• CVE-2026-6919

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-chromeos_22.html

Google Chrome 多個漏洞

發佈日期: 2026年04月28日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料及繞過保安限制。

---

影響

• 資料洩露
• 繞過保安限制

---

受影響之系統或技術

• Google Chrome 147.0.7727.116 (Linux) 之前的版本
• Google Chrome 147.0.7727.116/117 (Mac) 之前的版本
• Google Chrome 147.0.7727.116/117 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 147.0.7727.116 (Linux) 或之後版本
• 更新至 147.0.7727.116/117 (Mac) 或之後版本
• 更新至 147.0.7727.116/117 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2026-6919
• CVE-2026-6920
• CVE-2026-6921

---

資料來源

• Google Chrome

---

相關連結

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html

Google Chrome Multiple Vulnerabilities

Release Date: 28 Apr 2026

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure and security restriction bypass on the targeted system.

---

Impact

• Information Disclosure
• Security Restriction Bypass

---

System / Technologies affected

• Google Chrome prior to 147.0.7727.116 (Linux)
• Google Chrome prior to 147.0.7727.116/117 (Mac)
• Google Chrome prior to 147.0.7727.116/117 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 147.0.7727.116 (Linux) or later
• Update to version 147.0.7727.116/117 (Mac) or later
• Update to version 147.0.7727.116/117 (Windows) or later

---

Vulnerability Identifier

• CVE-2026-6919
• CVE-2026-6920
• CVE-2026-6921

---

Source

• Google Chrome

---

Related Link

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html

Microsoft Edge 繞過保安限制漏洞

發佈日期: 2026年04月28日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制。

---

影響

• 繞過保安限制

---

受影響之系統或技術

• Microsoft Edge 147.0.3912.86 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 147.0.3912.86 或之後版本

---

漏洞識別碼

• CVE-2026-6919
• CVE-2026-6921

---

資料來源

• Microsoft Edge

---

相關連結

• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-24-2026
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6919
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6921