今日共收录 1730 条安全情报，包含 831 个 CVE，478 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-41840
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affec
CVE-2026-41839
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerab
CVE-2026-41838
IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible
CVE-2026-41720
Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username i
CVE-2026-41715
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may
CVE-2026-41710
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the applicati
CVE-2026-41007
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
CVE-2026-41006
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media ty
CVE-2026-40984
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (
CVE-2026-40983
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (
CVE-2026-26236
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vul
CVE-2026-11623
A security vulnerability has been detected in tmux up to 3.6a. Affected is the function image_free of the file image.c.
CVE-2026-11603
The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[f
CVE-2026-10738
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{
CVE-2026-10553
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i
CVE-2026-10024
The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Att
CVE-2026-7556
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in
CVE-2026-5714
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘location_dir’ parame
CVE-2026-11621
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /adm
CVE-2026-11620
A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsf