今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表CVE-2026-67277
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An
CVE-2026-67276
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user
CVE-2025-15647
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge in
CVE-2026-18238
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its heade
CVE-2026-18313
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received fro
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad
CVE-2026-86192
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys end
CVE-2026-86191
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t
CVE-2026-86190
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user record
CVE-2026-86189
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to w
CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing
CVE-2026-86186
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eigh
CVE-2026-86184
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows un
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
CVE-2026-86176
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A
CVE-2026-86169
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_cod
CVE-2026-86121
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and