首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 17030 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-104053 | MEDIUM | 6.3 | 2026-10-02 | A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacte | itsourcecode Pet Shop Management System | 请参考厂商官方公告并升级修复。官方说明：https://github.com/LAt-forever/vuldb-doc |
| CVE-2026-104054 | MEDIUM | 6.3 | 2026-10-02 | A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the functi | calcom cal.diy | 请参考厂商官方公告并升级修复。官方说明：https://github.com/calcom/cal.diy/ |
| CVE-2026-104480 | 待定 | 待定 | 2026-10-02 | Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting grou | Discord libdave | 受影响版本 < 9686fbaea864aa19f0675e486672b6a77811b6a1，请升级到修复版本。 |
| CVE-2026-21140 | 待定 | 待定 | 2026-10-02 | Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows loca | Samsung Mobile Samsung Mobile Devices | 受影响版本 < *，请升级到修复版本。 |
| CVE-2026-104120 | HIGH | 7.3 | 2026-10-02 | A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mc | modelcontextprotocol mcp-server-fetch, m | 请参考厂商官方公告并升级修复。官方说明：https://github.com/modelcontextprotocol/ |
| CVE-2026-104123 | HIGH | 7.3 | 2026-10-02 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affe | SourceCodester Online Reviewer Managemen | 请参考厂商官方公告并升级修复。官方说明：https://github.com/lemssh77/cve/issues/1 |
| CVE-2026-14378 | CRITICAL | 9.8 | 2026-10-02 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Admi | dplugins DevKit Pro | 受影响版本 ≤ 2.3.0，请升级到修复版本。 |
| CVE-2026-93367 | HIGH | 7.2 | 2026-10-02 | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauth | wp-buy Visitor Traffic Real Time Statist | 受影响版本 ≤ 11.22，请升级到修复版本。 |
| CVE-2026-103096 | HIGH | 7.5 | 2026-10-02 | API key is hardcoded and retrievable from the application package. Since Android applicati | GeoVision Inc. GV-Eye | 请参考厂商官方公告并升级修复。官方说明：https://www.geovision.com.tw/cyber_secur |
| CVE-2026-103097 | HIGH | 7.5 | 2026-10-02 | An API key is hardcoded and retrievable from the application package. Since Android applic | GeoVision Inc. GV-Eye | 请参考厂商官方公告并升级修复。官方说明：https://www.geovision.com.tw/cyber_secur |
| CVE-2026-71454 | 待定 | 待定 | 2026-10-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | CWE-79 - Cross-site Scripting CAPEC-63 | 受影响版本 < 3.0b63，请升级到修复版本。 |
| CVE-2026-86344 | HIGH | 7.5 | 2026-10-01 | A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LD | Red Hat Red Hat Directory Server 11, Red | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2025-71427 | MEDIUM | 6.8 | 2026-10-01 | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that al | GongRzhe Office-PowerPoint-MCP-Server | 受影响版本 ≤ 2.0.7，请升级到修复版本。 |
| CVE-2026-103760 | MEDIUM | 5.9 | 2026-10-01 | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability t | kvcache-ai Mooncake | 受影响版本 ≤ 0.3.13.post1，请升级到修复版本。 |
| CVE-2026-103761 | HIGH | 7.5 | 2026-10-01 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability i | kvcache-ai Mooncake | 受影响版本 ≤ 0.3.13.post1，请升级到修复版本。 |
| CVE-2026-103764 | CRITICAL | 9.8 | 2026-10-02 | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in Server | kvcache-ai Mooncake | 受影响版本 < 0.3.13，请升级到修复版本。 |
| CVE-2026-103765 | CRITICAL | 9.4 | 2026-10-02 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP | kvcache-ai Mooncake | 受影响版本 ≤ 0.3.13.post1，请升级到修复版本。 |
| CVE-2026-103766 | HIGH | 7.2 | 2026-10-02 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authe | MacWarrior clipbucket-v5 | 受影响版本 ≤ 5.5.3-#197，请升级到修复版本。 |
| CVE-2026-86345 | CRITICAL | 9 | 2026-10-02 | A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffe | Red Hat Red Hat Directory Server 11, Red | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-51897 | 待定 | 待定 | 2026-10-01 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). | n/a | 请参考厂商官方公告并升级修复。官方说明：https://gist.github.com/Ro1ME/7101a09720 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。