今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CVE-2026-72701
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string compar
CVE-2026-72700
The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation
CVE-2026-72699
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register(
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing
CVE-2026-72697
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to vali
CVE-2026-72696
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local a
CVE-2026-72695
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated u
CVE-2026-56709
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token
CVE-2026-56708
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attac
CVE-2026-56707
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects
CVE-2026-56706
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (form
CVE-2026-56704
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without
CVE-2026-56703
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not bl
CVE-2026-34968
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop actio
CVE-2026-34967
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in th
CVE-2026-19801
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnera
CVE-2026-15023
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection
CVE-2026-10630
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress
CVE-2026-66766
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vu
CVE-2026-59183
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in