今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-52842
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the en
CVE-2026-50148
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.2
CVE-2026-44986
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitation
CVE-2026-43637
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files ou
CVE-2026-61451
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url fi
CVE-2026-56699
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, a
CVE-2026-5270
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage
CVE-2026-5269
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used fo
CVE-2026-51808
Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the open
CVE-2026-51807
Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the j2k_
CVE-2026-48334
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in t
CVE-2026-46634
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a
CVE-2026-46633
Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template n
CVE-2026-45363
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(t
CVE-2026-38450
An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name
CVE-2026-53486
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files an
CVE-2026-52101
An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via
CVE-2026-48327
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the
CVE-2026-48325
ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary co
CVE-2026-48324
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulner