今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-37065
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&ac
CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker
CVE-2026-37012
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user te
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via ma
CVE-2026-37006
A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker
CVE-2026-37004
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote att
CVE-2026-37003
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and Sh
CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrat
CVE-2026-34620
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to applicat
CVE-2026-34616
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory ex
CVE-2026-30612
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <=
CVE-2026-25250
EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot
CVE-2026-18886
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. Th
CVE-2026-18885
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnera
CVE-2026-18374
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the
CVE-2026-10036
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary c
CVE-2026-81827
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That doe
CVE-2026-81826
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This m
CVE-2026-81820
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: *