今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。
← 返回归档列表CVE-2026-118304
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execut
CVE-2026-118307
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitra
CVE-2026-86948
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An a
CVE-2026-33924
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient va
CVE-2026-33923
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent valid
CVE-2026-113697
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticate
CVE-2026-113696
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.
CVE-2026-113695
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite version
CVE-2026-113694
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.
CVE-2026-113693
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.
CVE-2026-113692
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and
CVE-2026-113690
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.
CVE-2026-113689
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.
CVE-2026-113688
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3
CVE-2026-118311
Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbi
CVE-2026-118313
Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insi
CVE-2026-114398
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HT
CVE-2026-66092
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encod
CVE-2026-66091
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation
CVE-2026-66090
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user