今日共收录 1224 条安全情报，包含 453 个 CVE，382 篇安全通告，以及 98 篇研究论文。
← 返回归档列表CVE-2026-48051
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery sy
CVE-2026-45623
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileg
CVE-2026-17569
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only per
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-adm
CVE-2026-17552
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten
CVE-2026-66731
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser
CVE-2026-66730
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unau
CVE-2026-66729
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows u
CVE-2026-66391
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Ap
CVE-2026-66390
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. Th
CVE-2026-24252
NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of
CVE-2026-17531
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality
CVE-2026-17192
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authentica
CVE-2026-66399
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows admi
CVE-2026-66398
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated
CVE-2026-66397
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, al
CVE-2026-66396
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cov
CVE-2026-66394
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows
CVE-2026-59251
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthentica