今日共收录 1110 条安全情报，包含 284 个 CVE，411 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-46725
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.
CVE-2026-46724
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer config
CVE-2026-46723
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backe
CVE-2026-46722
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document place
CVE-2026-46721
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on th
CVE-2026-46586
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluate
CVE-2026-45434
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution T
CVE-2026-45187
Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users
CVE-2026-35086
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue a
CVE-2026-31910
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Us
CVE-2026-31909
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFB
CVE-2026-31906
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. Thi
CVE-2026-31388
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: bef
CVE-2026-31387
Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are rec
CVE-2026-31380
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') v
CVE-2026-31379
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname
CVE-2026-31378
Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are r
CVE-2026-29226
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects A
CVE-2026-29220
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issu
CVE-2026-29207
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects