Latest Vulnerabilities

100 items

2026-09-29用友时空KSOA /vote/joinvoting.jsp SQL 注入漏洞
2026-09-29用友政务系统 /ma/api/selectMaEmpByOrgCode 未授权访问漏洞
2026-09-29Apache Cocoon /xmlui/themes/Mirage2 目录遍历漏洞
2026-09-29中科商软云连ERP /admin/session!ajaxList.action 未授权访问漏洞
2026-09-29ZKTeco-百傲瑞达安防管理系统平台 /authLicenseAction!getLicenseInfo.do 代码执行漏洞
2026-09-29CRMEB /api/remote_register 权限绕过漏洞
2026-09-29鼎游票务系统 /saleVersionUpdate.jsp 文件读取漏洞
2026-09-29Flowise /api/v1/chatflows 未授权访问漏洞
2026-09-29Langflow /api/v1/flows/ 未授权访问漏洞
2026-09-29QAnything /api/local_doc_qa/upload_files 文件上传漏洞（CVE-2026-88533）
2026-09-29Apache Kafka UI /smartfilters/testexecutions 代码执行漏洞（CVE-2026-78166）
2026-09-29用友NC /ebvp/infopub/showcontent SQL 注入漏洞
2026-09-29Netbox-Docker /api/status/ 默认口令漏洞（CVE-2023-27573）
2026-09-29Xboot /xboot/common/swagger/login 服务器端请求伪造漏洞
PoC2026-09-28CVE-2024-57728: SimpleHelp <= 5.5.7 - Arbitrary File Upload
PoC2026-09-28CVE-2025-11452: Asgaros Forum < 3.2.0 - SQL Injection
PoC2026-09-28CVE-2025-34033: Blue Angel Software Suite (5V Technologies) - OS Command Injection
PoC2026-09-28CVE-2025-62593: Ray < 2.52.0 - Remote Code Execution
PoC2026-09-28CVE-2025-68273: Signal K Server <= 2.18.0 - Information Disclosure
PoC2026-09-28CVE-2026-12227: Visual Composer <= 45.16.0 - Unauthenticated LFI
PoC2026-09-28CVE-2026-25703: NeuVector - Information Disclosure
PoC2026-09-28CVE-2026-56681: 9router <=0.5.4 - Authentication Bypass
PoC2026-09-28CVE-2026-61560: GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access
PoC2026-09-28CVE-2026-87902: WordPress Core - PHP Template Path Traversal
PoC2026-09-28CVE-2026-89013: Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter
PoC2026-09-28CVE-2026-89063: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access
PoC2026-09-28mcp-streamable-http-exposure: MCP Streamable HTTP Server - Unauthenticated Initialize
2026-09-24关于U9 cloud存在命令执行漏洞的安全通告
2026-09-24关于U9 cloud存在接口反序列化漏洞的安全通告
2026-09-24浪潮GS7前台SQL注入漏洞
2026-09-24致远互联分析云 DownloadFile 接口存在任意文件读取漏洞
2026-09-24融易網路｜GPM LIGHT - Sensitive Data Exposure
2026-09-23银河麒麟桌面操作系统权限提升漏洞
2026-09-23达梦新云缓存数据库二进制漏洞
2026-09-23山石网科下一代防火墙SG-6000弱口令漏洞
2026-09-23统信UOS操作系统本地提权漏洞
2026-09-23天融信上网行为管理系统命令执行漏洞
2026-09-23南大通用GBase 8c二进制漏洞
2026-09-23SISCO MMSLite MMS协议字段拒绝服务漏洞
2026-09-23SISCO MMSLite MMS协议OSI层拒绝服务漏洞
2026-09-23统信操作系统拒绝服务漏洞
2026-09-23统信桌面操作系统任意文件写入漏洞
PoC2026-09-23CVE-2026-49060: Hippoo Mobile App for WooCommerce - Broken Access Control
PoC2026-09-23CVE-2026-58467: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
PoC2026-09-23CVE-2026-6639: AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure
PoC2026-09-23CVE-2026-80099: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret
PoC2026-09-23oidc-signing-alg-none-supported: OpenID Connect - Unsigned (alg none) ID Token Supported
PoC2026-09-23powerdns-monitor-exposure: PowerDNS Authoritative Server Monitor - Unauthenticated Exposure
PoC2026-09-23qdrant-telemetry-exposure: Qdrant - Telemetry Exposure
2026-09-23关于NC系统的文件控制台SQL注入漏洞的安全通告
2026-09-23全景軟體｜CGServiSign - OS Command Injection
2026-09-21关于U8+渠道管理(高级版)存在sql注入漏洞的公告
PoC2026-09-21CVE-2021-42392: H2 Database Console - JNDI Injection RCE
PoC2026-09-21CVE-2026-13153: Essential Blocks < 6.4.0 - Information Disclosure
PoC2026-09-21CVE-2026-1340: Ivanti EPMM < 12.8.0.0 - Remote Code Execution
PoC2026-09-21CVE-2026-42018: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
PoC2026-09-21CVE-2026-55549: Yamcs <=5.8.6 - Cross-Site Scripting
PoC2026-09-21CVE-2026-69085: SiYuan <=3.7.2 - SQL Injection
PoC2026-09-21CVE-2026-82456: argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access
PoC2026-09-21CVE-2026-84434: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload
PoC2026-09-21CVE-2026-85688: TEN Framework - Arbitrary File Read & Write
PoC2026-09-21CVE-2026-86218: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
PoC2026-09-21CVE-2026-9103: Langflow OSS - Superuser Token Issuance
PoC2026-09-21http-etcd-unauthenticated-api-v3: etcd v3 Unauthenticated API
PoC2026-09-21http-etcd-unauthenticated-raft: etcd RAFT Unauthenticated API
PoC2026-09-21wordpress-click2shell: WordPress Click2Shell Theme Preview Selector Injection
2026-09-18桓基科技｜OAKlouds - 存在2個漏洞
2026-09-18云智慧数据中心智能运维管理平台存在任意用户登录漏洞
2026-09-18大洋融云融媒体系统存在未授权访问漏洞
2026-09-18索贝凌云商城单点登录存在登录绕过
2026-09-18北信源防病毒系统存在SQL注入
2026-09-18安天智甲终端防御系统存在任意文件读取
2026-09-18VX Talent人事管理云存在前台任意文件上传
2026-09-18无人值守称重管理系统存在SQL注入漏洞
2026-09-18成都冠唐科技设备云维保管理系统存在未授权访问漏洞
2026-09-18成都冠唐科技设备云维保管理系统存在sql注入漏洞
2026-09-18CuteHttpFileServer/chfs存在未授权任意文件上传
2026-09-18杭州加砖信息科技有限公司智慧监测系统存在SQL注入
2026-09-18金富瑞-UCML 应用框架存在文件上传漏洞
2026-09-18金蝶eascloud管理控制端任意文件上传
2026-09-18电子证据管理系统-index.php存在SQL注入
2026-09-18泛微ecology8 getCptInfoMap 存在SQL注入漏洞
PoC2026-09-17CVE-2026-18072: Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass
PoC2026-09-17CVE-2026-27960: OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
PoC2026-09-17flowise-chatflows-exposure: Flowise AI - Unauthenticated Chatflows API Exposure
PoC2026-09-17langflow-api-exposure: Langflow - Unauthenticated API Exposure
PoC2026-09-17arangodb-auth-bypass: ArangoDB - Authentication Bypass via URL-Encoded Underscore (%5f) to RCE
PoC2026-09-16CVE-2020-29134: TOTVS Fluig <= 1.7.0 - Arbitrary File Read
PoC2026-09-16CVE-2023-54391: Proxmox VE - Default Credentials with TFA Bypass
PoC2026-09-16CVE-2025-51683: mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE
PoC2026-09-16CVE-2025-57231: Docmost 0.2.1-0.21.0 - Arbitrary File Read
PoC2026-09-16CVE-2026-0561: Shield Security <= 21.0.8 - Unauthenticated Reflected XSS
PoC2026-09-16CVE-2026-0650: OpenFlagr <= 1.1.18 - Authentication Bypass
PoC2026-09-16CVE-2026-0702: VidShop for WooCommerce <= 1.1.4 - SQL Injection
PoC2026-09-16CVE-2026-0768: Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code
PoC2026-09-16CVE-2026-1281: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
PoC2026-09-16CVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation
PoC2026-09-16CVE-2026-19632: TranslatePress <= 3.3.1 - Unauthenticated Account Takeover
PoC2026-09-16CVE-2026-2113: tpadmin <= 1.3.12 - Remote Code Execution
PoC2026-09-16CVE-2026-21875: ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection