今日共收录 966 条安全情报，包含 229 个 CVE，399 篇安全通告，以及 34 篇研究论文。
← 返回归档列表CVE-2026-41656
## Summary The `add` mode in `modules/documents-files.php` accepts a `name` parameter validated only as `'string'` type
CVE-2026-41655
## Summary The `ecard_preview.php` endpoint does not validate that the `ecard_template` POST parameter is a safe filena
CVE-2026-7401
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulne
CVE-2026-7400
A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is
CVE-2025-50328
A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of th
CVE-2026-34965
Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection en
CVE-2026-7407
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerabilit
CVE-2026-7403
A security flaw has been discovered in geldata gel-mcp 0.1.0. This impacts the function list_rules/fetch_rule of the fil
CVE-2026-7408
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save
CVE-2026-7404
A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_p
CVE-2018-25311
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows auth
CVE-2018-25306
PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by process
CVE-2026-42226
## Impact The `dynamic-node-parameters` endpoints did not verify whether the authenticated caller was authorized to use
CVE-2026-42234
## Impact An authenticated user with permission to create or modify workflows containing a Python Code Node could escape
CVE-2026-42227
## Impact An authenticated user with a valid API key scoped to `variable:list` could read variables from projects they a
CVE-2026-42236
## Impact The MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without ad
CVE-2026-42228
## Impact The `/chat` WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature did not verify that an inco
关于Microsoft ExchangeServer存在多个...
该输入实质上为北京市公安局网站的备案信息查询页面，标题为公安备案号，来源为360CERT安全报告，但实际链接指向公安备案查询系统，并无任何威胁情报内容。摘要部分为空，无CVE、攻击者、恶意软件、行业、地区、ATT&CK技术或IOC等信息。该
该输入为无效情报数据。标题 '（总）网出证（京）字第281号' 是网络出版服务许可证编号，来源链接指向360的许可页面，而非安全报告。摘要为空，发布时间为未来时间（2026年），tags虽提及 malware/apt 但无实际内容。因此无法