The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC me...

CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote ...

CVE-2026-40541

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain

历史摘要 · 未重新核验 · NVD

NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

CVE-2026-82082

NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inje

历史摘要 · 未重新核验 · NVD

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the clus...

CVE-2026-61800

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

历史摘要 · 未重新核验 · NVD

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be ...

CVE-2026-78239

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote at

历史摘要 · 未重新核验 · NVD

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command executio...

CVE-2026-76943

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to byp

历史摘要 · 未重新核验 · NVD

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root di...

CVE-2026-75337

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The us

历史摘要 · 未重新核验 · NVD

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker c...

CVE-2026-73125

Ebyte device web management interface does not consistently enforce authentication before granting access to administra

历史摘要 · 未重新核验 · NVD

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass ...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacke

历史摘要 · 未重新核验 · NVD

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation...

CVE-2026-69658

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta

历史摘要 · 未重新核验 · NVD

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to ...

CVE-2026-50152

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

历史摘要 · 未重新核验 · NVD

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remot...

CVE-2026-81934

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-d

历史摘要 · 未重新核验 · NVD

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framewo...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Ev

历史摘要 · 未重新核验 · NVD

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compil...

CVE-2026-59283

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable

历史摘要 · 未重新核验 · NVD

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Pr...

CVE-2026-37006

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker

历史摘要 · 未重新核验 · NVD

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke...

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rend

历史摘要 · 未重新核验 · NVD

关于Microsoft ExchangeServer存在多个...

关于Microsoft ExchangeServer存在多个...

历史摘要 · 未重新核验 · CNCERT

关于家用路由器DNS被恶意篡改导致异常跳转风险的提示

关于家用路由器DNS被恶意篡改导致异常跳转风险的提示

历史摘要 · 未重新核验 · CNCERT

京公网安备 11000002002063号

该输入仅包含一个网站备案号（京公网安备 11000002002063号），来源标注为 360CERT 安全报告，但未提供任何正文、摘要、CVE、攻击者、恶意软件、行业、地区或 ATT&CK 技术等实质性威胁情报内容。发布字段中的日期为 20

历史摘要 · 未重新核验 · 360CERT 安全报告

（总）网出证（京）字第281号

该条输入并非实际的威胁情报报告，而是360CERT网站上的一个许可证备案页面，标题为“（总）网出证（京）字第281号”，来源URL指向360官网的licence页面。输入中未包含任何摘要、正文、CVE编号、攻击者信息、恶意软件家族、受影响行

历史摘要 · 未重新核验 · 360CERT 安全报告