今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-104963
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc
CVE-2026-104962
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/mem
CVE-2026-104961
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=Tru
CVE-2026-104960
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w
CVE-2026-104956
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts grou
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request
CVE-2026-104894
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL pat
CVE-2026-104893
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user
CVE-2026-102779
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 -
CVE-2026-102777
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension <
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the
CVE-2026-88397
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid
CVE-2026-88396
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload i
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data
CVE-2026-37719
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .N
CVE-2026-105397
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authent
CVE-2026-105329
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms
CVE-2026-104892
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This
CVE-2026-104891
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-cond
CVE-2026-104890
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/