今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表CVE-2026-82245
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic
CVE-2026-82243
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint tha
CVE-2026-82242
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo
CVE-2026-82241
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.
CVE-2026-82240
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi
CVE-2026-82239
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin
CVE-2026-82238
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to w
CVE-2026-82237
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cl
CVE-2026-82236
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes ano
CVE-2026-82235
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing at
CVE-2026-82234
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agen
CVE-2026-82233
SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolut
CVE-2026-82111
A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of
CVE-2026-81777
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing.
CVE-2026-81733
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin
CVE-2026-81732
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoint
CVE-2026-78073
Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked esc
CVE-2026-78072
Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1
CVE-2026-78071
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location tit
CVE-2026-78070
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Sav