今日共收录 1106 条安全情报，包含 305 个 CVE，402 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-41856
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on
CVE-2026-41700
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacki
CVE-2026-41699
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An a
CVE-2026-41001
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's da
CVE-2026-41000
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-ti
CVE-2026-40999
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections
CVE-2026-40998
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed atta
CVE-2026-40997
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or dis
CVE-2026-40996
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for
CVE-2026-40995
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped
CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation di
CVE-2026-40992
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail
CVE-2026-40987
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the
CVE-2026-40986
Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not
CVE-2026-10795
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all version
CVE-2026-40985
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.
CVE-2026-2827
The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notificati
CVE-2026-53465
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25
CVE-2026-53464
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25
CVE-2026-53463
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-