今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表CVE-2026-28928
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, m
CVE-2026-28911
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A m
CVE-2026-17552
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten
CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
CVE-2026-66395
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler
CVE-2026-51303
A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs becaus
CVE-2026-51302
SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg func
CVE-2026-51300
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoki
CVE-2026-16812
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile
CVE-2026-17162
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc
CVE-2026-17166
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress
CVE-2026-12939
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p
CVE-2026-12938
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the
CVE-2026-12144
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl
CVE-2026-15735
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field'
CVE-2026-66064
## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned pat
CVE-2026-54659
### Summary `Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching
CVE-2026-54639
### Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious'
CVE-2026-54650
## Summary openhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the origi
CVE-2026-54638
### Impact A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, p