今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-56339
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY
CVE-2026-59235
Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListContro
CVE-2026-40633
Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sen
CVE-2026-8281
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-58077
The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated requ
CVE-2026-57833
The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature.
CVE-2026-57821
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and
CVE-2026-56287
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versi
CVE-2026-49501
Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Pri
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to a
CVE-2026-57832
The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection.
CVE-2026-57831
The Joomla extension DP Calendar is vulnerable to an unauthenticated SQL injection.
CVE-2026-15804
The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands
CVE-2026-15583
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's enviro
CVE-2026-14251
A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when
CVE-2026-42936
The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory wh
CVE-2026-12512
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before us
CVE-2026-12281
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without
CVE-2026-11580
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capab
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload