今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-16568
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe
CVE-2026-16567
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token
CVE-2026-13416
The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming
CVE-2026-13415
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of it
CVE-2026-13414
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a
CVE-2026-81491
A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes
CVE-2026-16895
A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service i
CVE-2026-81486
A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_conte
CVE-2026-81485
A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the
CVE-2026-19398
“unsupported-when-assigned.” An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a
CVE-2026-81421
A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown functio
CVE-2026-80183
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-sc
CVE-2026-47874
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor N
CVE-2026-47863
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a
CVE-2026-47862
An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default
CVE-2026-47861
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can caus
CVE-2026-47860
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the c
CVE-2026-47859
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frame
CVE-2026-47857
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a
CVE-2026-47856
Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,