今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentia
CVE-2026-93289
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute
CVE-2026-92391
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal
CVE-2026-92390
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an
CVE-2026-92092
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory an
CVE-2026-8374
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the el
CVE-2026-87941
Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-86589
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer
CVE-2026-86019
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows
CVE-2026-82819
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manip
CVE-2026-79704
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0)
CVE-2026-78066
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled inp
CVE-2026-78058
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms all
CVE-2026-78048
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version
CVE-2026-77884
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The
CVE-2026-74758
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to cras
CVE-2026-70386
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vul
CVE-2026-61789
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL
CVE-2026-61671
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle
CVE-2026-57146
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-