今日共收录 918 条安全情报，包含 88 个 CVE，417 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-80202
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions
CVE-2026-80201
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call
CVE-2026-80200
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unva
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t
CVE-2026-80197
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints
CVE-2026-80196
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after passwo
CVE-2026-80195
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PA
CVE-2026-80194
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_pro
CVE-2026-80192
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) con
CVE-2026-80191
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated use
CVE-2026-80189
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in int
CVE-2026-76149
CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.
CVE-2026-73335
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A m
CVE-2026-58092
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was st
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would
CVE-2026-58090
The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket b
CVE-2026-58089
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivi
CVE-2026-54467
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 ac
CVE-2026-52776
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versio