今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。
← 返回归档列表CVE-2026-103357
Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrec
CVE-2026-103071
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooC
CVE-2026-108583
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach int
CVE-2026-108582
GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows
CVE-2026-108581
TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileg
CVE-2026-108580
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI
CVE-2026-108579
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed sp
CVE-2026-108555
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other
CVE-2026-108554
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticate
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeControll
CVE-2026-108549
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in pla
CVE-2026-108547
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users t
CVE-2026-108546
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote at
CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attacke
CVE-2026-108115
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to b
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all
CVE-2026-97264
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPA
CVE-2026-97263
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPA
CVE-2026-94676
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This iss