今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表CVE-2026-73658
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5,
CVE-2026-73479
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac
CVE-2026-73428
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to sto
CVE-2026-73420
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the
CVE-2026-73417
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
CVE-2026-73408
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multip
CVE-2026-73304
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id
CVE-2026-73302
Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa
CVE-2026-73039
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated
CVE-2026-72857
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated user
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execu
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/cro
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This atta
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has b
CVE-2026-56860
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitr
CVE-2026-56853
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they
CVE-2026-33818
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.