今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。
← 返回归档列表CVE-2026-72724
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/c
CVE-2026-72723
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.ano
CVE-2026-72722
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_
CVE-2026-72721
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChec
CVE-2026-72720
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse
CVE-2026-72719
Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transf
CVE-2026-72718
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system
CVE-2026-66738
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint
CVE-2026-56620
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error repor
CVE-2026-48158
use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34,
CVE-2026-48048
XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Sta
CVE-2026-72761
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses afte
CVE-2026-72760
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. Whe
CVE-2026-72759
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization
CVE-2026-19433
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before
CVE-2026-18412
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 exten
CVE-2026-71959
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /c
CVE-2026-63105
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated custome
CVE-2026-59112
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability
CVE-2026-18503
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume si