今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-81836
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file sr
CVE-2026-81835
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instruct
CVE-2026-80179
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing
CVE-2026-78037
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated atta
CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client
CVE-2026-77341
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes
CVE-2026-76945
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An
CVE-2026-76940
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout m
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT
CVE-2026-75814
The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management inte
CVE-2026-75813
Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access
CVE-2026-75548
The affected Ebyte device web management interface does not restrict the interface from being rendered within an extern
CVE-2026-75419
go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/s
CVE-2026-75418
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An at
CVE-2026-75417
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat
CVE-2026-75339
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload
CVE-2026-75337
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The us
CVE-2026-73839
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the r
CVE-2026-71396
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
CVE-2026-68967
Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that