今日共收录 1910 条安全情报，包含 1065 个 CVE，437 篇安全通告，以及 97 篇研究论文。
← 返回归档列表CVE-2026-73069
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace ad
CVE-2026-72920
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC s
CVE-2026-17061
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2
CVE-2026-48056
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 impro
CVE-2026-46670
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-imp
CVE-2026-72748
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that a
CVE-2026-58115
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running In
CVE-2026-18972
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-M
CVE-2026-72603
An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbit
CVE-2026-72599
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the ne
CVE-2026-72550
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to ex
CVE-2026-58231
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially craf
CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no v
CVE-2026-19516
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the graf
CVE-2026-13716
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to u
CVE-2026-19425
Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated re
CVE-2026-44758
SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted
CVE-2026-34265
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol pars
CVE-2026-18948
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, whic
CVE-2026-72880
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in pack