今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing
CVE-2026-86186
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eigh
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri
CVE-2026-15550
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to
CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a mi
CVE-2025-15614
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z arc
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
CVE-2026-86176
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A
CVE-2026-86173
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unaut
CVE-2026-86169
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_cod
CVE-2026-86123
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and exec
CVE-2026-86122
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure ar
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
CVE-2026-86117
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users in