今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-6876
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue c
CVE-2026-66353
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allow
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu ent
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, conc
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When de
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report T
CVE-2026-59320
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing th
CVE-2026-59319
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values w
CVE-2026-59317
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and
CVE-2026-59316
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When usi
CVE-2026-59315
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response split
CVE-2026-59313
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Ev
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choos
CVE-2026-59307
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all
CVE-2026-59306
Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud
CVE-2026-59305
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stre
CVE-2026-59304
Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Clou
CVE-2026-59303
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cl
CVE-2026-59302
Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0