今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-117499
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavi
CVE-2026-115408
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions
CVE-2026-115216
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contac
CVE-2026-10756
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access s
CVE-2026-10752
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, a
CVE-2026-109995
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site
CVE-2026-106087
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read
CVE-2026-105323
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and
CVE-2026-102800
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, w
CVE-2026-117541
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash calle
CVE-2026-117540
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedl
CVE-2026-117539
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow att
CVE-2026-117538
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the func
CVE-2026-117537
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inje
CVE-2026-117536
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/
CVE-2026-117535
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, wher
CVE-2026-117534
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows att
CVE-2026-117533
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves up
CVE-2026-117530
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted command
CVE-2026-117466
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full s