今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CVE-2026-19892
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to
CVE-2026-17089
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site S
CVE-2026-14280
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion i
CVE-2026-78685
Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote
CVE-2026-75982
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in version
CVE-2026-75019
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress
CVE-2026-10627
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass i
CVE-2025-9878
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cr
CVE-2026-78682
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.l
CVE-2026-78681
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations
CVE-2026-78680
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygrap
CVE-2026-78679
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional refere
CVE-2026-78678
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --co
CVE-2026-78677
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary g
CVE-2026-78675
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local f
CVE-2026-76846
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access
CVE-2026-76839
Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and
CVE-2026-75575
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may
CVE-2026-75574
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as
CVE-2026-72702
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, w