今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-87776
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connecti
CVE-2026-86793
SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configure
CVE-2024-12145
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi
CVE-2026-89147
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an u
CVE-2026-89146
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to
CVE-2026-86813
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that
CVE-2026-86809
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to i
CVE-2026-85116
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over th
CVE-2026-82213
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested be
CVE-2026-77159
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based ch
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does n
CVE-2026-87123
hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping
CVE-2026-47839
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite oper
CVE-2026-17037
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site
CVE-2026-87727
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to
CVE-2026-80469
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypa
CVE-2026-19486
A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions
CVE-2025-15679
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a pa
CVE-2026-89179
WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerab
CVE-2026-89178
WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unau