今日共收录 1224 条安全情报，包含 453 个 CVE，382 篇安全通告，以及 98 篇研究论文。
← 返回归档列表CVE-2026-9830
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission cal
CVE-2026-66412
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read mileston
CVE-2026-14827
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it in
CVE-2026-14820
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-log
CVE-2026-14568
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration Wor
CVE-2026-14236
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it
CVE-2026-14235
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session
CVE-2026-14203
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML
CVE-2026-14190
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them
CVE-2026-13726
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the respons
CVE-2026-13400
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and incl
CVE-2026-13390
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggrega
CVE-2026-13152
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registrat
CVE-2026-12982
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration reques
CVE-2026-10082
The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it
CVE-2025-15662
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-suppl
CVE-2026-15928
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in
CVE-2026-17501
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file commo