今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-59355
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validat
CVE-2026-32564
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
CVE-2026-32550
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
CVE-2026-78333
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticat
CVE-2026-78139
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one
CVE-2026-78138
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sal
CVE-2026-78137
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthen
CVE-2026-78125
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in a
CVE-2026-77991
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The admin
CVE-2026-77990
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.
CVE-2026-77989
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - bui
CVE-2026-77035
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve
CVE-2026-77034
Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager
CVE-2026-77018
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate
CVE-2026-77017
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine t
CVE-2026-76549
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its bac
CVE-2026-59278
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these m
CVE-2026-59275
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — fu
CVE-2026-59274
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an at