今日共收录 2403 条安全情报，包含 1575 个 CVE，408 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-74935
Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39,
CVE-2026-74934
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 11
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether th
CVE-2026-45532
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnera
CVE-2026-23938
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/sc
CVE-2026-23937
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential
CVE-2026-23935
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript
CVE-2026-23934
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically craft
CVE-2026-23933
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed
CVE-2026-23931
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values
CVE-2026-23930
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically cra
CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter proces
CVE-2026-23922
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a mali
CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly co
CVE-2026-16309
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessi
CVE-2026-75855
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database an
CVE-2026-75853
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (S
CVE-2026-75850
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP hand
CVE-2026-75846
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTI
CVE-2026-75845
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP serv