今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-105997
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code email
CVE-2026-105972
The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before
CVE-2026-104694
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before u
CVE-2026-103688
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its a
CVE-2026-103382
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notification
CVE-2026-103372
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning it
CVE-2026-115522
Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (
CVE-2026-104383
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premise
CVE-2026-99100
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p5
CVE-2026-1928
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in
CVE-2026-118276
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString o
CVE-2026-118275
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the
CVE-2026-116613
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and incl
CVE-2026-111727
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_subm
CVE-2026-111255
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary
CVE-2026-97019
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headlin
CVE-2026-118384
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
CVE-2026-118378
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute
CVE-2026-118377
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthentica
CVE-2026-118375
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() f