今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-100107
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing
CVE-2026-92924
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget outpu
CVE-2026-91020
The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amoun
CVE-2026-90987
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server,
CVE-2026-90952
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the Wo
CVE-2026-85005
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and ex
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated
CVE-2026-79618
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its
CVE-2026-63569
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Cas
CVE-2026-63568
Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legio
CVE-2026-63567
Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a rem
CVE-2026-63566
Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in
CVE-2026-1661
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before r
CVE-2026-16001
Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngin
CVE-2026-16000
Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc
CVE-2026-15999
Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion
CVE-2026-13413
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while
CVE-2026-102565
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' p
CVE-2026-97318
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren