今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。
← 返回归档列表CVE-2026-79913
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side requ
CVE-2026-79312
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the re
CVE-2026-79311
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
CVE-2026-77633
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs
CVE-2026-77621
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated
CVE-2026-77620
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decom
CVE-2026-77619
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit c
CVE-2026-75608
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker
CVE-2026-75607
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards
CVE-2026-75517
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use
CVE-2026-75511
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URL
CVE-2026-75510
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox
CVE-2026-70410
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avati
CVE-2026-63374
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri
CVE-2026-95754
In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentica
CVE-2026-95703
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem pro
CVE-2026-95701
In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path co
CVE-2026-95698
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organizatio
CVE-2026-95697
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to t
CVE-2026-95693
In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(),