今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。
← 返回归档列表CVE-2026-19049
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries,
CVE-2026-18960
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, al
CVE-2026-18946
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded thr
CVE-2026-18934
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed
CVE-2026-18786
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and
CVE-2026-18666
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter befor
CVE-2026-18470
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the a
CVE-2026-18469
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a se
CVE-2026-18468
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the acc
CVE-2026-18200
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user
CVE-2026-18030
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password
CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connecto
CVE-2026-17541
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowin
CVE-2026-17540
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any au
CVE-2026-17023
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth s
CVE-2026-17022
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token befor
CVE-2026-17021
The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-mod
CVE-2026-17020
The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the call
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and
CVE-2026-17018
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restric