今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表CVE-2026-10571
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecu
CVE-2026-73651
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Ora
CVE-2026-73481
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / b
CVE-2026-73038
NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to esca
CVE-2026-73037
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter
CVE-2026-18071
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege manageme
CVE-2026-17197
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of
CVE-2026-73645
OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0
CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti
CVE-2026-73565
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request t
CVE-2026-73562
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.
CVE-2026-67613
CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitra
CVE-2026-19730
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TR
CVE-2026-18428
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenti
CVE-2019-25765
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attack
CVE-2026-73266
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exp
CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
CVE-2026-59109
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic in
CVE-2026-58507
Private Repository Existence Disclosure via go-get Meta Endpoint
CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API