The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to i...

CVE-2026-18561

该漏洞影响 WordPress 的 Unlimited Elements For Elementor 插件 2.0.16 及之前所有版本，类型为未认证 SQL 注入，NVD 给出的 CVSS 3.1 评分为 7.5（向量 AV:N/AC:L

历史摘要 · 未重新核验 · NVD

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up ...

CVE-2026-15462

CVE-2026-15462 是 WordPress 插件 Sticky Chat Widget（1.4.2 及更早版本）中的一个 SQL 注入漏洞。该插件通过 scw_save_form_data 这个 AJAX 动作接收前端提交的表单数

历史摘要 · 未重新核验 · NVD

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerabili...

CVE-2026-12215

该漏洞影响 WordPress 插件 OTP Login & Register Woocommerce 的所有版本直至并包括 2.7.2。插件在 `process_otp_form` 中实现的一次性密码（OTP）尝试次数限流，其计数器完全以

历史摘要 · 未重新核验 · NVD

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning

该论文针对监督学习中的训练期数据投毒问题开展了一项实证评估研究。作者指出，数据投毒通过污染训练数据，既可以泛化地降低模型整体性能，也可以植入由攻击者控制的目标行为（后门）。为厘清这两类威胁在不同条件下的表现差异，研究选取了两类具有代表性的训

历史摘要 · 未重新核验 · arXiv cs.CR

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and includ...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthoriz

历史摘要 · 未重新核验 · NVD

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

历史摘要 · 未重新核验 · NVD

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Co...

CVE-2026-88260

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulne

历史摘要 · 未重新核验 · NVD

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentic...

CVE-2026-78135

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CH

历史摘要 · 未重新核验 · NVD

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers wi...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error pag

历史摘要 · 未重新核验 · NVD

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in de...

CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server retur

历史摘要 · 未重新核验 · NVD

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow i...

CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file cont

历史摘要 · 未重新核验 · NVD

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.

CVE-2026-78134

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a

历史摘要 · 未重新核验 · NVD

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.

CVE-2026-78133

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.

历史摘要 · 未重新核验 · NVD

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

CVE-2026-78132

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax

历史摘要 · 未重新核验 · NVD

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.

CVE-2026-78131

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribu

历史摘要 · 未重新核验 · NVD

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.

CVE-2026-78130

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.

历史摘要 · 未重新核验 · NVD

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.

CVE-2026-78129

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.

历史摘要 · 未重新核验 · NVD

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

CVE-2026-78127

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE mess

历史摘要 · 未重新核验 · NVD

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.

历史摘要 · 未重新核验 · NVD

strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

CVE-2026-78124

strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of relea

历史摘要 · 未重新核验 · NVD