今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-83744
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the f
CVE-2026-83743
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve
CVE-2026-82747
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
CVE-2026-77823
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv A
CVE-2026-76006
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the
CVE-2026-75965
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v
CVE-2026-75921
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template
CVE-2026-19952
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file
CVE-2026-19948
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress
CVE-2026-19796
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cr
CVE-2026-19573
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortc
CVE-2026-18752
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all vers
CVE-2026-17589
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order'
CVE-2026-16787
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via
CVE-2026-13203
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via
CVE-2026-12747
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode A
CVE-2026-82749
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni
CVE-2026-82748
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i
CVE-2026-82746
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies
CVE-2026-82745
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS