今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-63306
stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed e
CVE-2026-63305
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and
CVE-2026-63304
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the list
CVE-2026-12391
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) with
CVE-2025-71388
stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission
CVE-2025-71377
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching me
CVE-2024-58360
stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verifica
CVE-2026-59249
Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malici
CVE-2026-35149
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized us
CVE-2026-35148
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints ar
CVE-2026-35147
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verif
CVE-2026-35146
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish conn
CVE-2026-7543
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions
CVE-2026-6424
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the syste
CVE-2026-6423
A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authenti
CVE-2026-58078
The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection.
CVE-2026-15727
The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in
CVE-2026-15651
The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' para
CVE-2026-15407
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7
CVE-2026-15350
The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.