今日共收录 1190 条安全情报，包含 490 个 CVE，393 篇安全通告，以及 21 篇研究论文。
← 返回归档列表CVE-2026-40214
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. Th
CVE-2026-40213
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This un
CVE-2026-34327
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attac
CVE-2026-33823
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
CVE-2026-32207
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an
CVE-2026-26164
Improper neutralization of special elements in output used by a downstream component ('injection') in M365 Copilot allow
CVE-2026-26129
Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over
CVE-2026-42449
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In ve
CVE-2026-41692
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.
CVE-2026-41691
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internat
CVE-2026-8142
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use
CVE-2026-8088
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the
CVE-2026-8087
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frm
CVE-2026-42501
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum databa
CVE-2026-42499
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2026-42259
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-
CVE-2026-39836
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
CVE-2026-39826
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASC
CVE-2026-39825
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite functi
CVE-2026-39823
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL