今日共收录 942 条安全情报，包含 169 个 CVE，438 篇安全通告，以及 68 篇研究论文。
← 返回归档列表CVE-2026-93986
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allow
CVE-2026-93984
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptograph
CVE-2026-93983
OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users
CVE-2026-93982
OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plain
CVE-2026-93981
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a stri
CVE-2026-9858
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and
CVE-2026-9766
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin
CVE-2026-9613
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all version
CVE-2026-9289
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi
CVE-2026-8354
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' paramete
CVE-2026-76579
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all
CVE-2026-5410
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions
CVE-2026-1256
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple A
CVE-2026-1255
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
CVE-2026-9855
The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all
CVE-2026-9615
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. T
CVE-2026-9232
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
CVE-2026-87917
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynam
CVE-2026-85658
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres
CVE-2026-75959
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' paramet