首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 15900 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-86566 | MEDIUM | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the cop | Red Hat Fast Datapath for RHEL 10, Red H | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-86567 | HIGH | 8.8 | 2026-10-14 | A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers w | Red Hat Fast Datapath for RHEL 10, Red H | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-86845 | MEDIUM | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached | Red Hat Fast Datapath for RHEL 10, Red H | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-86846 | MEDIUM | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descript | Red Hat Fast Datapath for RHEL 10, Red H | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-86847 | MEDIUM | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an un | Red Hat Fast Datapath for RHEL 10, Red H | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-77371 | 待定 | 待定 | 2026-10-14 | Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the Duck | getredash redash | 请参考厂商官方公告并升级修复。官方说明：https://github.com/getredash/redash/comm |
| CVE-2026-79957 | HIGH | 8.1 | 2026-10-14 | ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsu | ServiceNext SerTec | 请参考厂商官方公告并升级修复。官方说明：https://blog.blacklanternsecurity.com/p/ |
| CVE-2026-109527 | HIGH | 7.5 | 2026-10-14 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protoco | modelcontextprotocol python-sdk | 请参考厂商官方公告并升级修复。官方说明：https://github.com/modelcontextprotocol/ |
| CVE-2026-110777 | MEDIUM | 5.7 | 2026-10-14 | A flaw was found in evolution-data-server. Calendar events containing a file:// URI in the | GNOME evolution-data-server, Red Hat Red | 受影响版本 < 3.62.1，请升级到修复版本。 |
| CVE-2026-42093 | 待定 | 待定 | 2026-10-14 | Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26 | getredash redash | 请参考厂商官方公告并升级修复。官方说明：https://github.com/getredash/redash/comm |
| CVE-2026-54554 | HIGH | 7.5 | 2026-10-14 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior | FOGProject | 请参考厂商官方公告并升级修复。官方说明：https://github.com/FOGProject/fogproject |
| CVE-2026-55572 | CRITICAL | 10 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's o | e107inc e107 | 请参考厂商官方公告并升级修复。官方说明：https://github.com/e107inc/e107/commit/1 |
| CVE-2026-55573 | CRITICAL | 9.8 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacke | e107inc e107 | 请参考厂商官方公告并升级修复。官方说明：https://github.com/e107inc/e107/commit/5 |
| CVE-2026-76083 | 待定 | 待定 | 2026-10-14 | Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON | getredash redash | 请参考厂商官方公告并升级修复。官方说明：https://github.com/getredash/redash/comm |
| CVE-2026-107350 | HIGH | 8.8 | 2026-10-14 | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who kn | n/a PgBouncer | 受影响版本 < 1.26.1，请升级到修复版本。 |
| CVE-2026-108151 | MEDIUM | 5.3 | 2026-10-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MD | PluginUs.Net MDTF | 受影响版本 ≤ 1.3.9，请升级到修复版本。 |
| CVE-2026-108390 | CRITICAL | 9.9 | 2026-10-14 | Hestia Control Panel is a lightweight and powerful control panel for the modern web. From | hestiacp | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hestiacp/hestiacp/com |
| CVE-2026-108395 | HIGH | 7.5 | 2026-10-14 | The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol se | modelcontextprotocol io.modelcontextprot | 请参考厂商官方公告并升级修复。官方说明：https://github.com/modelcontextprotocol/ |
| CVE-2026-108480 | HIGH | 8.2 | 2026-10-14 | Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorr | Skydropx | 受影响版本 ≤ 2.1.4，请升级到修复版本。 |
| CVE-2026-108483 | HIGH | 7.1 | 2026-10-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | hippooo Hippoo Mobile App for WooCommerc | 受影响版本 ≤ 1.12.0，请升级到修复版本。 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。