今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-105773
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Help
CVE-2026-105768
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before versio
CVE-2026-105741
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing v
CVE-2026-105699
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenti
CVE-2026-105698
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not
CVE-2026-105447
A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuratio
CVE-2026-105444
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the fi
CVE-2026-105438
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general
CVE-2026-102262
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attac
CVE-2026-101893
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Fi
CVE-2026-97257
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object I
CVE-2026-95265
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The priv
CVE-2026-95264
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can del
CVE-2026-95263
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-upda
CVE-2026-94201
Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a fil
CVE-2026-93617
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Inj
CVE-2026-78862
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the prin
CVE-2026-78861
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
CVE-2026-78860
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plainte
CVE-2026-71299
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This