今日共收录 1006 条安全情报，包含 268 个 CVE，456 篇安全通告，以及 21 篇研究论文。
← 返回归档列表CVE-2026-58234
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nes
CVE-2026-44766
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious in
CVE-2026-86544
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly
CVE-2026-86541
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows att
CVE-2026-86540
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, a
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoi
CVE-2026-86538
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that al
CVE-2026-86439
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, creat
CVE-2026-82758
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker
CVE-2026-82757
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who
CVE-2026-82756
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthen
CVE-2026-82753
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allow
CVE-2026-82586
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read att
CVE-2026-82584
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious pa
CVE-2026-81638
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit sever
CVE-2026-86438
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-
CVE-2026-86437
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edi
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing aut
CVE-2026-86287
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths ar
CVE-2026-16028
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes