今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CVE-2026-16231
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML esc
CVE-2026-12878
In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin per
CVE-2026-78566
The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This ma
CVE-2026-78563
The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu
CVE-2026-78562
The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. T
CVE-2026-77146
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-exi
CVE-2026-77145
The permission check for the frontend management update flow verified a different event than the one the request went on
CVE-2026-77144
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the
CVE-2026-77143
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modi
CVE-2026-77142
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for c
CVE-2026-77141
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and
CVE-2026-77140
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving an
CVE-2026-77138
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserial
CVE-2026-77137
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged b
CVE-2026-77136
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly i
CVE-2026-77135
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target
CVE-2026-77134
The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a re
CVE-2026-77133
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the prof
CVE-2026-77131
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encr