今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch
CVE-2026-72833
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerabili
CVE-2026-72832
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss()
CVE-2026-72831
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in it
CVE-2026-72828
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. Th
CVE-2026-72827
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows lo
CVE-2026-72825
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/
CVE-2026-72823
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its
CVE-2026-72821
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field op
CVE-2026-72820
Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directori
CVE-2026-72819
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation tha
CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves th
CVE-2026-72816
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The real
CVE-2026-72815
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blind
CVE-2026-72814
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-exi
CVE-2026-72813
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests
CVE-2026-72812
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint tha
CVE-2026-72810
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allow
CVE-2026-19822
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of
CVE-2025-71405
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses t