今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-89177
WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due
CVE-2026-89176
WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerabili
CVE-2026-89175
Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability
CVE-2026-89174
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerabi
CVE-2026-89173
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. U
CVE-2026-6642
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset e
CVE-2026-6641
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shor
CVE-2026-6640
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attribut
CVE-2026-87908
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not inc
CVE-2026-86815
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job,
CVE-2026-86812
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoint
CVE-2026-86782
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing
CVE-2026-86781
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or
CVE-2026-86780
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value be
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a sit
CVE-2026-85678
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it
CVE-2026-85677
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed eleme
CVE-2026-83546
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML
CVE-2026-83545
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside a
CVE-2026-82305
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given