今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2025-69904
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on t
CVE-2026-9160
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website T
CVE-2026-89099
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam
CVE-2026-89090
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allo
CVE-2026-87910
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archi
CVE-2026-82617
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FIND
CVE-2026-82535
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at
CVE-2026-81909
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concre
CVE-2026-81908
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The list
CVE-2026-7298
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software
CVE-2026-78807
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP
CVE-2026-68528
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting
CVE-2026-67211
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0
CVE-2026-18495
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer tru
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization;
CVE-2026-72708
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where th
CVE-2026-54047
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior t
CVE-2026-18061
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0
CVE-2026-8304
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Explo
CVE-2026-89265
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoin