今日共收录 1190 条安全情报，包含 490 个 CVE，393 篇安全通告，以及 21 篇研究论文。
← 返回归档列表CVE-2026-33109
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove
CVE-2026-42284
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_
CVE-2026-41902
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-s
CVE-2025-63704
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user
CVE-2025-63703
npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().
CVE-2026-8207
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr
CVE-2026-6667
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users
CVE-2026-6666
A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response
CVE-2026-7652
The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthe
CVE-2026-41705
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized
CVE-2026-6664
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to
CVE-2026-6665
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the conten
CVE-2026-44458
### Summary The JSX renderer escapes `style` attribute object values for HTML but not for CSS. Untrusted input in a `st
CVE-2026-44459
### Summary Improper validation of the JWT NumericDate claims `exp`, `nbf`, and `iat` in `hono/utils/jwt` allows tokens
CVE-2026-44966
### Summary A prototype pollution vulnerability was discovered in Velocity.js )[key] = val`. Because there is no valid
CVE-2026-6860
Potential unbounded server-side SNI `SslContext` cache growth in Vert.x TLS handling, with possible resource-exhaustion
CVE-2026-44457
### Summary Cache Middleware does not skip caching for responses that declare per-user variance via `Vary: Authorizatio
CVE-2026-44983
### Summary An integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap all
CVE-2026-44788
### Summary A path traversal vulnerability in `IArchive.WriteToDirectory()` allows a malicious archive to create direct
CVE-2026-44900
### Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the b