今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。
← 返回归档列表CVE-2026-85949
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive info
CVE-2026-81856
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publ
CVE-2026-109399
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_opens
CVE-2026-109398
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in l
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated vi
CVE-2026-109394
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that
CVE-2026-109393
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOr
CVE-2026-109392
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to
CVE-2026-109391
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated atta
CVE-2026-109195
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespace
CVE-2026-109194
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify w
CVE-2026-108901
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown f
CVE-2026-108900
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.
CVE-2026-108899
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicp
CVE-2026-107248
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any
CVE-2026-105668
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over
CVE-2026-105280
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarbal
CVE-2026-103503
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and h
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a m