今日共收录 1277 条安全情报，包含 517 个 CVE，386 篇安全通告，以及 105 篇研究论文。
← 返回归档列表CVE-2026-9090
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplyi
CVE-2026-38702
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 f
CVE-2026-48840
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of unini
CVE-2026-47397
# Bug Report: Arbitrary File Write in Python API ## Summary Hidden metadata in a webpage causes PraisonAI agents to wr
CVE-2026-47394
## Summary The fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four
CVE-2026-47390
### Summary PraisonAI's `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The aff
CVE-2026-47398
Arbitrary code execution via ungated spec.loader.exec_module in agents_generator.py (v4.6.32 chokepoint refactor bypass)
CVE-2026-47266
### Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formi
CVE-2026-47268
#### Summary An authenticated Nezha dashboard user can create or update a DDNS profile with provider `webhook` and conf
CVE-2026-47234
## Summary When debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs th
CVE-2026-47231
## Summary `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` o
CVE-2026-47230
## Summary `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder m
CVE-2026-47227
## Summary `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspon
CVE-2026-47213
#### Summary BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI
CVE-2026-47212
### Description The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the statu
CVE-2026-48557
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanit
CVE-2026-4387
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication s
CVE-2026-42500
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid
CVE-2026-48555
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows rem
CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible