今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。
← 返回归档列表CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact p
CVE-2026-72584
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attac
CVE-2026-72583
A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated us
CVE-2026-72582
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to cras
CVE-2026-72581
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker
CVE-2026-72579
An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept
CVE-2026-72578
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to
CVE-2026-72576
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Autho
CVE-2026-72574
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control
CVE-2026-72573
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execut
CVE-2026-72572
A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and down
CVE-2026-72571
A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker t
CVE-2026-72570
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to injec
CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial o
CVE-2026-72566
A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authent
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to a
CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function compute
CVE-2026-71392
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. Whe
CVE-2026-71391
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index b
CVE-2026-66642
Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP