PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow...
CVE-2021-47967
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject
2026-05-16 归档
今日共收录 1030 条安全情报，包含 296 个 CVE，439 篇安全通告，以及 15 篇研究论文。
← 返回归档列表WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload...
CVE-2021-47965
WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor com
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts...
CVE-2026-45010
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where...
CVE-2026-46361
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and resu
Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account...
CVE-2021-47962
Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
CVE-2026-45610
## Summary **Type:** Cross-site request forgery on the 2FA toggle. `plugin/LoginControl/set.json.php` accepts `POST typ
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site...
CVE-2026-23695
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in t
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud...
CVE-2026-2031
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prio
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
CVE-2026-45715
### Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an au
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
CVE-2026-45548
## Vulnerability Details **CWE-918**: Server-Side Request Forgery (SSRF) The `processUrlFile` function in `packages/se
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
CVE-2026-41147
### Impact NukeViet CMS `, which are stored server-side and executed in the browser of any user who views the content.
SimpleSAMLphp casserver: Open Redirect in logout
CVE-2025-65954
### Summary The logout endpoint accepts a `url` query parameter to redirect to. casserver treats that url as trusted,
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner ...
CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The
A supply chain attack compromised the official installation packages of DAEMON Tools Lite ...
CVE-2026-8398
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421
vm2 Has a Sandbox Breakout Using Async Generator
CVE-2026-45411
### Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape fro
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
CVE-2026-45370
## Summary `_prepare_environment()` in `cli_communication_protocol.py` passes a full copy of `os.environ` to every CLI
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
CVE-2026-45369
## Summary The `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` va
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
CVE-2026-45366
## Summary The `@utcp/http` package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-bound
Firewall for AI
Firewall for AI
Microsoft Exchange, Windows 11 hacked on second day of Pwn2Own
During the second day of Pwn2Own Berlin 2026, competitors collected $385,750 in cash awards after exploiting 15 unique