今日共收录 1730 条安全情报，包含 831 个 CVE，478 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-11651
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code i
CVE-2026-11638
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a s
CVE-2026-11634
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially p
CVE-2026-52778
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar f
CVE-2026-11393
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might a
CVE-2026-41448
AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthent
CVE-2026-39910
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attacker
CVE-2026-25555
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middlewa
CVE-2025-66276
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250
CVE-2025-58468
A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers
CVE-2026-53675
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any aut
CVE-2026-53673
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authen
CVE-2026-53674
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when user
CVE-2026-47838
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead
CVE-2026-41726
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r
CVE-2026-41731
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a
CVE-2026-41719
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep
CVE-2026-41730
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist
CVE-2026-41837
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and
CVE-2026-41729
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (app