今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-11325
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository,
CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when re
CVE-2026-67284
Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authentica
CVE-2026-64955
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CS
CVE-2026-64952
The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLL
CVE-2026-64951
A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic
CVE-2026-18663
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Sess
CVE-2026-18652
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within
CVE-2026-67283
Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenti
CVE-2026-67282
Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker
CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix
CVE-2026-19426
POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directl
CVE-2025-41771
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerabl
CVE-2025-41770
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an rem
CVE-2026-19594
Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-dep
CVE-2026-19217
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTM
CVE-2026-19073
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one o
CVE-2026-19052
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX ac
CVE-2026-19050
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the ca
CVE-2026-18962
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload int