今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-103329
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to s
CVE-2026-97468
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptograph
CVE-2026-86463
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pat
CVE-2026-79650
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentica
CVE-2026-78384
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted
CVE-2026-71575
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds
CVE-2026-108039
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML docume
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max
CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XM
CVE-2026-96761
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-
CVE-2026-96671
Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross
CVE-2026-96607
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms ne
CVE-2026-96553
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSe
CVE-2026-96539
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalat
CVE-2026-96518
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur
CVE-2026-96461
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control
CVE-2026-96337
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur
CVE-2026-96336
Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue af
CVE-2026-96334
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Conf