今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with
CVE-2026-76581
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,
CVE-2026-40541
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain
CVE-2026-82082
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inje
CVE-2026-61800
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
CVE-2026-78239
Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote at
CVE-2026-76943
Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to byp
CVE-2026-73125
Ebyte device web management interface does not consistently enforce authentication before granting access to administra
CVE-2026-71187
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacke
CVE-2026-69658
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta
CVE-2026-50152
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-d
CVE-2026-19092
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rend
CVE-2026-81735
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was g
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, al
CVE-2026-81701
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in
CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that
CVE-2026-81098
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mc
CVE-2026-81096
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authenticat
CVE-2026-57499
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log