The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all version...

CVE-2026-4883

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are...

CVE-2026-41919

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. Thi

历史摘要 · 未重新核验 · NVD

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, whic...

CVE-2026-31986

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. U

历史摘要 · 未重新核验 · NVD

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cr...

CVE-2026-2611

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

历史摘要 · 未重新核验 · NVD

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in ...

CVE-2026-4885

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file typ

历史摘要 · 未重新核验 · NVD

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor...

CVE-2026-8838

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver befor

历史摘要 · 未重新核验 · NVD

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this pro...

CVE-2026-27130

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection throu

历史摘要 · 未重新核验 · NVD

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vuln...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appiu

历史摘要 · 未重新核验 · NVD

关于Microsoft ExchangeServer存在多个...

关于Microsoft ExchangeServer存在多个...

历史摘要 · 未重新核验 · CNCERT

[分享]家庭千兆穿墙Wi-Fi路由器完整规格清单（按总分排序）

[分享]家庭千兆穿墙Wi-Fi路由器完整规格清单（按总分排序）

历史摘要 · 未重新核验 · 看雪

SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access

Critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email secur

历史摘要 · 未重新核验 · The Hacker News

Measuring Safety Alignment Effects in Autonomous Security Agents

该论文研究了安全对齐的语言模型及其未审查或消除对齐的衍生版本在作为自主安全代理运行时是否表现出不同的行为。传统的单轮拒绝基准无法回答这个问题，因为安全代理必须检查代码仓库、调用工具并在授权的沙箱内生成漏洞证据。作者提出了一个基于轨迹的基准测

历史摘要 · 未重新核验 · arXiv cs.CR

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing ...

CVE-2026-7385

Decent Comments 是一个 WordPress 插件，用于管理网站评论。在 3.0.2 版本之前，该插件通过 REST API 端点暴露了评论作者和文章作者的电子邮件地址。由于未对 API 访问进行权限检查，任何未认证的攻击者都

历史摘要 · 未重新核验 · NVD

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. T...

CVE-2026-6566

该漏洞存在于 WordPress 插件 NextGEN Gallery（版本 <= 4.2.0）中，是一个不安全的直接对象引用（IDOR）漏洞。漏洞位于 REST API 的图像删除端点 DELETE /imagely/v1/images/

历史摘要 · 未重新核验 · NVD

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

CVE-2026-47784

该漏洞存在于 memcached 1.6.42 之前版本中，与 SASL 密码数据库认证相关。在 sasl_server_userdb_checkpass 函数中，密码比对使用了 memcmp 函数，该函数非恒定时间比较，导致存在定时侧信道

历史摘要 · 未重新核验 · NVD

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_s...

CVE-2026-47783

memcached 1.6.42 之前版本中的 SASL 密码数据库认证机制存在计时侧信道漏洞。在函数 sasl_server_userdb_checkpass 中，当验证用户名时，循环一旦找到有效用户名就会立即退出，导致认证失败与成功的响

历史摘要 · 未重新核验 · NVD

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update pro...

CVE-2026-44392

Movable Type 存在一个授权缺失漏洞（Missing authorization vulnerability）。在特定条件下，当没有管理员权限的用户登录该产品时，可能会执行意外的更新处理。该漏洞允许低权限用户触发未经授权的操作，影

历史摘要 · 未重新核验 · NVD

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including,...

CVE-2026-2955

该漏洞存在于WordPress插件AI Chatbot & Workflow Automation by AIWU中，影响版本至1.4.14（含）。漏洞类型为存储型跨站脚本（XSS），攻击者可通过HTTP请求中的X-Forwarded-Fo

历史摘要 · 未重新核验 · NVD

A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This iss...

CVE-2026-9057

Talend Administration Center 中存在一个损坏的访问控制漏洞（CVE-2026-9057）。该漏洞允许拥有“查看”权限的用户修改 Talend Studio 更新 URL。由于权限分离不足，低权限用户能够通过操纵更

历史摘要 · 未重新核验 · NVD

A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be...

CVE-2026-9056

CVE-2026-9056 是 Talend Administration Center 中的一个存储型跨站脚本（XSS）漏洞。该漏洞允许具有服务器管理权限的攻击者存储恶意的 XSS 载荷，当其他用户（如管理员或普通用户）访问受影响的页面时

历史摘要 · 未重新核验 · NVD