今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-81679
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST AP
CVE-2026-81678
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extr
CVE-2026-81335
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch
CVE-2026-81334
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's
CVE-2026-81102
The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_serve
CVE-2026-81101
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute i
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src
CVE-2026-81099
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/htt
CVE-2026-81097
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with repl
CVE-2026-81095
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServ
CVE-2026-81093
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/co
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in serv
CVE-2026-81091
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in librar
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length
CVE-2026-80212
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource:
CVE-2026-80211
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_
CVE-2026-80210
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the
CVE-2026-80209
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading t
CVE-2026-79720
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hid