Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue a...

CVE-2026-39531

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit W

历史摘要 · 未重新核验 · NVD

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulner...

CVE-2025-71211

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code an

历史摘要 · 未重新核验 · NVD

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please n...

CVE-2025-71210

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code an

历史摘要 · 未重新核验 · NVD

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled '...

CVE-2026-5118

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2

历史摘要 · 未重新核验 · NVD

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potent...

CVE-2026-5433

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could

历史摘要 · 未重新核验 · NVD

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenti...

CVE-2026-4858

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration

历史摘要 · 未重新核验 · NVD

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalat...

CVE-2026-44050

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote auth

历史摘要 · 未重新核验 · NVD

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2....

CVE-2026-6279

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP F

历史摘要 · 未重新核验 · NVD

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable f...

CVE-2026-47372

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the buil

历史摘要 · 未重新核验 · NVD

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbi...

CVE-2026-8631

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vul

历史摘要 · 未重新核验 · NVD

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCom...

CVE-2026-45444

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using M

历史摘要 · 未重新核验 · NVD

关于Microsoft ExchangeServer存在多个...

关于Microsoft ExchangeServer存在多个...

历史摘要 · 未重新核验 · CNCERT

Measuring Safety Alignment Effects in Autonomous Security Agents

该论文研究了标准安全对齐的语言模型及其未经审查或消融衍生物在作为自主安全代理运行时的行为差异。现有单轮拒绝基准无法回答这一问题，因为安全代理需要检查仓库、调用工具并在授权沙箱中生成漏洞证据。作者提出了一种基于追踪的基准，包含30个本地漏洞分

历史摘要 · 未重新核验 · arXiv cs.CR

An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.

CVE-2026-9054

CVE-2026-9054 是一个存在于 Linux 内核网络协议栈中的拒绝服务漏洞。攻击者通过发送精心构造的 TCP、IL、RUDP 或 GRE 数据包，其总长度小于对应协议头部的最小长度，可触发内核在处理异常数据包时发生 panic（内

历史摘要 · 未重新核验 · NVD

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this f...

CVE-2026-9053

CVE-2026-9053 涉及 Mothra 软件在处理 HTML 文件上传表单时的一个安全漏洞。Mothra 会盲目信任网站提供的文件路径默认值，攻击者可以构造一个恶意网页，其中包含文件上传表单，并设置一个恶意的默认文件路径（例如指向系

历史摘要 · 未重新核验 · NVD

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escapi...

CVE-2026-4834

WP ERP Pro 插件是一款用于 WordPress 的企业资源规划插件，其所有版本（至 1.5.1 及包括该版本）中存在 SQL 注入漏洞。该漏洞源于对用户提供的 'search_key' 参数过滤不严以及 SQL 查询准备不足，导致

历史摘要 · 未重新核验 · NVD

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

CVE-2026-46598

该漏洞影响ed25519数字签名算法的私钥解析过程。当程序从网络接收或反序列化ed25519私钥的线格式字节时，如果输入是经过精心构造的畸形数据，则可能绕过格式检查，直接通过类型转换创建出内部状态不一致的PrivateKey对象。后续使用该

历史摘要 · 未重新核验 · NVD

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVE-2026-46597

CVE-2026-46597 是一个影响 AES-GCM 包解码器的安全漏洞。该漏洞源于一个错误的类型转换操作：在将字节（bytes）转换为整型（int）时，由于转换位置不当，导致对精心构造的输入数据，解码器会触发服务器端 panic。这种

历史摘要 · 未重新核验 · NVD

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-ad...

CVE-2026-46595

CVE-2026-46595 是 SSH 服务器配置中的一个授权绕过漏洞，该漏洞源于之前修复的 CVE-2024-45337 不完整。CVE-2024-45337 原本修复了因错误使用 SSH 服务器配置导致的授权绕过问题。然而，在 CVE

历史摘要 · 未重新核验 · NVD

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVE-2026-42508

该漏洞涉及证书颁发机构（CA）的签名密钥（SignatureKey）吊销验证缺失问题。在受影响的产品中，当CA的签名密钥被吊销后，系统在验证证书链时未正确检查该密钥的吊销状态，导致已吊销的密钥仍然可用于签名并被视为有效。具体来说，代码仅检查

历史摘要 · 未重新核验 · NVD