今日共收录 1483 条安全情报，包含 593 个 CVE，506 篇安全通告，以及 97 篇研究论文。
← 返回归档列表CVE-2026-77098
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to
CVE-2026-77097
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service a
CVE-2026-77092
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers
CVE-2026-77091
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved
CVE-2026-77089
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade t
CVE-2026-75021
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user su
CVE-2026-62437
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assig
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary pr
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually
CVE-2026-11573
Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via sta
CVE-2026-86714
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to
CVE-2026-86713
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_c
CVE-2026-86712
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste han
CVE-2026-86711
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-n
CVE-2026-80219
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthC
CVE-2026-77968
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] acros
CVE-2026-76931
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter
CVE-2026-74860
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providin
CVE-2026-3174
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a miss
CVE-2026-2520
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modific