今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-43850
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the syst
CVE-2026-43849
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
CVE-2026-113468
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment prov
CVE-2026-113459
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the edi
CVE-2026-113442
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker co
CVE-2026-113381
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItem
CVE-2026-113378
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src
CVE-2026-112240
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the requ
CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page recor
CVE-2026-112238
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the w
CVE-2026-112237
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method,
CVE-2026-112071
The order cancellation function accepts an order identifier from the request and acts on that order without checking tha
CVE-2026-112070
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widge
CVE-2026-112069
The extension no longer applied its access protection to files in file storages that use a non-default relative base pat
CVE-2026-112068
The backend module does not check whether a backend user has access to the requested site. Users with access to the modu
CVE-2026-112067
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can reque
CVE-2026-112066
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend us
CVE-2026-112065
The routes that provide consent history and statistics data did not check whether the backend user had access to the mod
CVE-2026-112064
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and u
CVE-2026-111844
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy