今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-59271
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown
CVE-2026-47894
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configure
CVE-2026-47889
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite att
CVE-2026-47888
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spr
CVE-2026-47887
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a con
CVE-2026-47886
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of
CVE-2026-47885
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -
CVE-2026-47883
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue ap
CVE-2026-47881
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for examp
CVE-2026-47880
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String
CVE-2026-47878
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes di
CVE-2026-47877
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
CVE-2026-47875
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deser
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and
CVE-2026-47849
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Pa
CVE-2026-19715
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it
CVE-2026-19454
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup
CVE-2026-19225
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators,
CVE-2026-19223
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an
CVE-2026-16569
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe