今日共收录 1483 条安全情报，包含 647 个 CVE，430 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-10524
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price
CVE-2025-6508
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to b
CVE-2025-15674
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from
CVE-2025-12317
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issue
CVE-2024-6541
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dy
CVE-2024-39024
In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.
CVE-2026-68750
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenti
CVE-2026-68749
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthe
CVE-2026-68747
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex
CVE-2026-66829
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow
CVE-2026-66370
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow
CVE-2026-5423
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT obj
CVE-2026-53985
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's serv
CVE-2026-53977
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to termi
CVE-2026-43622
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1bat
CVE-2026-3430
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL s
CVE-2026-19047
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/e
CVE-2026-19046
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown fu
CVE-2026-18427
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file hand