今日共收录 2403 条安全情报，包含 1575 个 CVE，408 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-67921
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and
CVE-2026-67920
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.Migration
CVE-2026-67846
Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect priv
CVE-2026-67262
Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit t
CVE-2026-63643
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodule
CVE-2026-63642
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfee
CVE-2026-63641
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as E
CVE-2026-63640
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the ca
CVE-2026-61696
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca
CVE-2026-54570
AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in An
CVE-2026-54552
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on
CVE-2026-53533
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), a
CVE-2026-52610
An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or
CVE-2026-52609
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitr
CVE-2026-52608
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitra
CVE-2026-52607
A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php
CVE-2026-50167
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpo
CVE-2026-50161
libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the
CVE-2026-50143
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation
CVE-2026-49452
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-