今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CVE-2026-77130
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control
CVE-2026-77129
The extension passes an editor-configurable email subject string directly into a Fluid template source without restricti
CVE-2026-77128
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user
CVE-2026-77127
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to se
CVE-2026-63587
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Aut
CVE-2026-56096
The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syn
CVE-2026-56095
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() functi
CVE-2026-56094
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the syste
CVE-2026-56093
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user
CVE-2026-56092
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requ
CVE-2026-17548
Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who
CVE-2026-78701
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentica
CVE-2026-78322
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with a
CVE-2026-67578
FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network
CVE-2026-66882
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows
CVE-2026-19851
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attack
CVE-2026-18512
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross
CVE-2026-18328
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based
CVE-2026-18323
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
CVE-2026-18100
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stor