今日共收录 1165 条安全情报，包含 370 个 CVE，402 篇安全通告，以及 115 篇研究论文。
← 返回归档列表CVE-2026-12130
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of t
CVE-2026-12129
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown
CVE-2026-54361
MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio
CVE-2026-54360
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the
CVE-2026-54359
MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. W
CVE-2026-54358
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accou
CVE-2026-54357
An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify
CVE-2026-54055
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability ex
CVE-2026-50552
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forger
CVE-2026-50287
AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a
CVE-2026-47260
Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via th
CVE-2026-43872
Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path
CVE-2026-42890
Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron
CVE-2026-42851
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty term
CVE-2026-42850
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the
CVE-2026-42604
Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server version
CVE-2026-53726
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version
CVE-2026-53725
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8
CVE-2026-53724
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version
CVE-2026-53408
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.