今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。
← 返回归档列表CVE-2026-118692
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers
CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint th
CVE-2026-118685
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the str
CVE-2026-118682
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing att
CVE-2026-107024
Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite anot
CVE-2026-107023
Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrari
CVE-2026-107021
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows u
CVE-2026-107019
Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthori
CVE-2026-107018
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read a
CVE-2026-107017
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers t
CVE-2026-107016
Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
CVE-2026-107014
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read no
CVE-2026-61996
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
CVE-2026-61989
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
CVE-2026-54865
Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.
CVE-2026-54864
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
CVE-2026-42701
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-42694
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allow
CVE-2026-27394
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
CVE-2026-118085
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.