今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表CVE-2026-19084
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured im
CVE-2026-14567
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowi
CVE-2026-14558
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises use
CVE-2026-12514
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab
CVE-2026-12513
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly saniti
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alt
CVE-2026-82089
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries da
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.
CVE-2026-77365
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vuln
CVE-2026-76053
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross
CVE-2026-3129
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `` tag attributes in a
CVE-2026-18983
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers
CVE-2026-18978
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all version
CVE-2026-18324
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
CVE-2026-16759
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited
CVE-2026-16654
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attrib
CVE-2026-15798
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all
CVE-2026-78618
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operatio
CVE-2026-78617
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowin
CVE-2026-78616
A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows