今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-85660
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function
CVE-2026-85651
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authent
CVE-2026-85650
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs tha
CVE-2026-85626
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff
CVE-2026-85625
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any ma
CVE-2026-85624
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that perform
CVE-2026-85623
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Atta
CVE-2026-85622
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the esta
CVE-2026-85621
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters
CVE-2026-85620
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to
CVE-2026-85619
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, all
CVE-2026-85618
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t
CVE-2026-85608
Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /
CVE-2026-85606
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts
CVE-2026-85605
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to
CVE-2026-82729
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the c
CVE-2026-82728
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to ex
CVE-2026-81859
CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken o
CVE-2026-81832
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 1
CVE-2026-6958
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanni