今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-80254
Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who ca
CVE-2026-3416
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared se
CVE-2026-84377
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.
CVE-2026-44506
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, t
CVE-2026-85396
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly valida
CVE-2026-85395
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any a
CVE-2024-33663 · CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded publi
CVE-2026-33894 · CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 sign
CVE-2026-85392
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attac
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deleti
CVE-2026-85389
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing
CVE-2026-25947 · CVE-2026-85388
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowin
CVE-2026-33630
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' quer
CVE-2026-85028
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component
CVE-2026-63219
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the A
CVE-2026-75602
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST
CVE-2026-85239
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify even
CVE-2026-53720
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does
CVE-2026-50554
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauth