今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表CVE-2026-82868
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-sup
CVE-2026-82867
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sani
CVE-2026-82866
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc
CVE-2026-82865
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that a
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()
CVE-2026-82863
@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging
CVE-2026-82862
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to sh
CVE-2026-82861
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoof
CVE-2026-82853
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH
CVE-2026-82668
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the functio
CVE-2026-82667
A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isVali
CVE-2026-82666
A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Co
CVE-2026-82665
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the fi
CVE-2026-82664
A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file a
CVE-2026-82662
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, a
CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing atta
CVE-2026-82660
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in
CVE-2026-82659
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowin
CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles Web
CVE-2026-19410
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on