今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-47159
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-valid
CVE-2026-41580
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirl
CVE-2026-54560
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens
CVE-2026-54563
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a c
CVE-2026-54562
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow acc
CVE-2026-61453
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detec
CVE-2026-61440
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members
CVE-2026-42049
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest int
CVE-2026-59733
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
CVE-2026-54572
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
CVE-2026-59732
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
CVE-2026-47730
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplat
CVE-2026-48125
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From
CVE-2026-61520
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery
CVE-2026-59889
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From
CVE-2026-47423
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedco
CVE-2026-53633
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode expo
CVE-2026-47428
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__v
CVE-2026-49352
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-
CVE-2026-46339
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/