今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。
← 返回归档列表CVE-2026-18197
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allow
CVE-2026-18192
VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to e
CVE-2026-63242
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to
CVE-2026-63241
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl
CVE-2026-63240
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers f
CVE-2026-63239
A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 bucke
CVE-2026-63238
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, incl
CVE-2026-63237
A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled s
CVE-2026-63236
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name,
CVE-2026-63235
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the se
CVE-2026-63231
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based
CVE-2026-63228
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content
CVE-2026-14300
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bin
CVE-2026-14234
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowin
CVE-2026-14224
The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-dat
CVE-2026-13690
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor log
CVE-2026-13605
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox ca
CVE-2026-11974
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in
CVE-2026-11351
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API e
CVE-2026-5626
The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec