今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-19654
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input se
CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rath
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerabi
CVE-2026-16445
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specia
CVE-2026-16255
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5
CVE-2026-15816
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs
CVE-2026-14288
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5
CVE-2026-13319
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and
CVE-2026-13097
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attribut
CVE-2026-119978
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by
CVE-2026-119482
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured
CVE-2026-119479
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder
CVE-2026-119368
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting
CVE-2026-119367
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting
CVE-2026-119365
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Pla
CVE-2026-116638
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls
CVE-2026-116566
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be
CVE-2026-115805
Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local use
CVE-2026-115711
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (E
CVE-2026-115709
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un