今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-51851
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:Fil
CVE-2026-37468
Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary
CVE-2026-22114
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhausti
CVE-2026-22110
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brut
CVE-2026-22109
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defau
CVE-2026-22105
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the dev
CVE-2026-19199
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-
CVE-2026-18629
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation
CVE-2026-15466
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in har
CVE-2026-117183
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the
CVE-2026-117182
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 all
CVE-2026-117028
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::che
CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in Exce
CVE-2026-110972
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backen
CVE-2026-110971
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decod
CVE-2026-110970
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-T
CVE-2026-107057
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
CVE-2026-107056
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized
CVE-2026-107055
Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to
CVE-2026-107053
Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write a