今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a
CVE-2026-86115
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat
CVE-2026-86113
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe
CVE-2026-86112
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth
CVE-2026-86111
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated
CVE-2026-76573
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_fo
CVE-2026-85414
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortco
CVE-2026-83625
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,
CVE-2026-75586
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[
CVE-2026-75018
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input be
CVE-2026-84936
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allo
CVE-2026-84935
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigat
CVE-2026-84934
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX acti
CVE-2026-84931
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before
CVE-2026-84930
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute
CVE-2026-84927
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Rev
CVE-2026-84926
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST route