今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-84796 · CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th
CVE-2026-72786 · CVE-2026-79989
The vulnerability allows any authenticated user to change their own password without providing the current password or h
CVE-2026-16647
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality
CVE-2026-73475
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce Pa
CVE-2026-73478
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.
CVE-2026-73474
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This
CVE-2026-73476
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This
CVE-2026-73477
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versi
CVE-2026-81167
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Sug
CVE-2026-81165
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from
CVE-2026-81168
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functiona
CVE-2026-81269
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field version
CVE-2026-81166
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Dig
CVE-2026-81162
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience
CVE-2026-81164
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF version
CVE-2026-81205
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Acti
CVE-2026-81201
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Men
CVE-2026-84808
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint
CVE-2026-84807
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team
CVE-2026-84806
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated