The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the '...

CVE-2026-89333

该漏洞是 WordPress 在线课程 / eLearning 插件 Tutor LMS 中的不安全直接对象引用（IDOR）。在 4.0.8 及之前的所有版本中，插件在处理 'student_id' 参数时，未对用户可控的键做归属校验与权限

历史摘要 · 未重新核验 · NVD

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and i...

CVE-2026-89093

CVE-2026-89093 是 WordPress 插件 Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots 中的一个信息暴露（越权访问）漏洞

历史摘要 · 未重新核验 · NVD

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the p...

CVE-2026-88944

Tutor LMS 是 WordPress 生态中广泛使用的在线课程与电子学习解决方案插件。CVE-2026-88944 指出，该插件在 4.0.8 及之前的所有版本中存在授权绕过缺陷：插件在执行与文章删除相关的处理逻辑时，没有正确校验当前

历史摘要 · 未重新核验 · NVD

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_d...

CVE-2026-15760

CVE-2026-15760 是 WordPress 插件 Divi Essential 中一个敏感信息泄露漏洞，影响范围覆盖直至并包含 5.8.1 的所有版本。漏洞根因位于插件对外暴露的两个 AJAX 动作处理函数 dnxte_get_d

历史摘要 · 未重新核验 · NVD

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient ...

CVE-2026-12042

CVE-2026-12042 是 WordPress 插件 WP2Social Auto Publish（用于将站点内容自动同步发布到社交平台）中存在的存储型跨站脚本（Stored XSS）漏洞，影响所有版本直至并包含 2.4.12。漏洞根

历史摘要 · 未重新核验 · NVD

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attacker...

CVE-2026-93922

该漏洞影响思源笔记（SiYuan）3.8.4 及之前的所有版本，属于存储型跨站脚本（Stored XSS）问题，CVSS 3.1 评分为 8.8（高危）。问题的根因在于「每日笔记（Daily Note）」选择器对话框在渲染笔记本（noteb

历史摘要 · 未重新核验 · NVD

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can ...

CVE-2026-93921

SiYuan 是一款开源的本地优先知识管理软件。在其 3.8.4 及之前版本中，getDynamicIcon 端点未能正确实施发布访问控制，导致仅持有只读令牌的用户可以绕过权限限制，访问受保护文档的元数据。攻击者可通过向该端点发送 type

历史摘要 · 未重新核验 · NVD

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access share...

CVE-2026-77875

CVE-2026-77875 属于认证边界与数据存储边界不一致导致的信息泄露类漏洞，出现在使用“计算器式”保险库（vault）口令保护的应用中。该应用在界面上要求用户先输入类似计算器的口令才能进入保险库查看内容，但这一认证机制只作用于应用自

历史摘要 · 未重新核验 · NVD

Compact Vision Models for Iris Presentation Attack Detection under Presentation Attack Instrument Shift and Environmental Degradation

虹膜活体检测（PAD）在安全关键场景中承担着区分真实虹膜与呈现攻击的职责，但一个在开发验证阶段表现可靠的子系统，一旦遇到验证数据中未出现的呈现攻击工具（PAI）或采集环境退化，性能就可能急剧崩塌。该论文正是围绕这一泛化性缺口展开：作者在 L

历史摘要 · 未重新核验 · arXiv cs.CR

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includ...

CVE-2026-93574

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending

历史摘要 · 未重新核验 · NVD

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending s...

CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote

历史摘要 · 未重新核验 · NVD

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_pa...

CVE-2026-85272

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawo

历史摘要 · 未重新核验 · NVD

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications func...

CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawo

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv...

CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/...

CVE-2026-71418

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plu...

CVE-2026-68928

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.Term

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompress...

CVE-2026-63452

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule t...

CVE-2026-63451

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treat...

CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

历史摘要 · 未重新核验 · NVD

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/pars...

CVE-2026-63449

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD