今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CVE-2026-79673
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write opera
CVE-2026-79672
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access toke
CVE-2026-79671
Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_sett
CVE-2026-79670
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Conten
CVE-2026-79669
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read a
CVE-2026-79668
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows una
CVE-2026-79667
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several p
CVE-2026-79666
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated us
CVE-2026-79665
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireSc
CVE-2026-79664
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintai
CVE-2026-79663
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdo
CVE-2026-79660
Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON seri
CVE-2026-79659
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses un
CVE-2026-79658
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware
CVE-2026-78864
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.update
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decod
CVE-2026-77997
Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A miss
CVE-2026-77996
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping i
CVE-2026-77824
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' p
CVE-2026-75971
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable